MisuseHealthcareProfessional ServicesHealthcarePrivilege AbuseDelayed DiscoveryCustomer Data InvolvedIdentity (basic)PHIPIIHealth (basic)MediumContained

Wonderland Child and Family Services

bd_ce40d0a436165a01 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 26, 2026

Filed

Apr 8, 2026

To disclose

10 weeks

Affected

1,282state residents only

Confidence

71%

Full breach record for Wonderland Child and Family Services →2 incidents on file

Washington state AG notice for Wonderland Child and Family Services regarding unauthorized access by a former employee on May 31, 2023. Discovered Jan 26, 2026. 1,282 Washington residents affected. PII viewed/copied. Organization retained legal counsel, investigated, and offered 12 months of credit monitoring and fraud assistance via Cyberscout.

J jump to incidentP pin to compareR raw source

Washington clock⏱ WA AG >30d10 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 971 days

discovery → filing · 10 weeks / 72 days

May 31, 2023

Begins

Jan 26, 2026

Discovered

Apr 8, 2026

Filed

vs. sector median

+1 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,282 affectedView incident

Name: Wonderland Child and Family Services
norm: wonderland child and family

Name: Wonderland Child and Family Services
norm: wonderland child and family
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jan 26, 2026
Breach occurred: May 31, 2023
Undetected for: 971 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 8, 2026
Affected individuals: 1,282state-resident count only
Data types: PIIIdentity (basic)
Data elements: NameDate of birthMedical information
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 500+dexposure 0d
WA-stated discovery: Found after the fact
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Initial access: insider_action

During the incident: Moved promptly to begin an investigation into the scope and nature of the unusual activity
Retained legal counsel to investigate further
Began a comprehensive review of the data set
Notifying potentially impacted individuals
Providing access to Single Bureau Credit Monitoring/Single Bureau Credit Report/Single Bureau Credit Score services at no charge
Providing proactive fraud assistance through Cyberscout
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: WA AG >30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA37617.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 8, 2026
Raw hash: 17aae9035b27a95b66cab164f6d85519ea67be98c408337bed879e386e6e3494

Reporting entityWonderland Child and Family Services

Victim entityWonderland Child and Family Services

Incidentdiscovered Jan 26, 2026

Stated responseMoved promptly to begin an investigation into the scope and nature of the unusual activity

ComplianceWA AG >30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com