Lycoming County Data Breach — Class Action Review

As a local government entity, Lycoming County functions as the administrative heart of the region, providing essential civic services ranging from public health oversight and social welfare administration to property tax collection, voter registration, and the maintenance of vital public records. Operating in this capacity requires the collection and retention of vast quantities of deeply personal and sensitive information regarding local residents, municipal employees, and local business owners. Because local governments serve as repositories for everything from marriage licenses and court filings to property deeds and municipal payroll records, they are trusted stewards of high-value personal data that is legally and operationally mandated to be stored securely.

In 2025, Lycoming County reported a significant cybersecurity incident to the Indiana Attorney General, highlighting vulnerabilities within its municipal digital infrastructure. While the exact vector of the attack remains under active investigation, breaches affecting local government and county administrative bodies typically involve sophisticated ransomware deployments, unauthorized intrusions into legacy internal databases, or compromises of third-party vendors utilized for public administration software. Municipal networks are frequently targeted by malicious cyber actors due to the sheer volume of concentrated data they hold and the often-constrained cybersecurity budgets typical of public sector organizations, leaving critical digital infrastructure exposed to exploitation.

The exposure resulting from this security incident threatens individuals with severe, long-term privacy and financial risks because of the nature of the data typically housed within county systems. Compromised records often include full names, Social Security numbers, dates of birth, home addresses, banking information for tax payments or county disbursements, and personnel files containing wage and employment histories. Access to this constellation of data creates an immediate danger of identity theft, fraudulent credit applications, tax refund fraud, and targeted phishing scams. When an individual's Social Security number and date of birth are compromised alongside their address and financial history, malicious actors possess all the necessary components to impersonate victims across multiple institutional domains.

Under applicable state and federal data protection frameworks, including the Indiana Disclosure of Security Breach Law and general common-law duties of care, municipal agencies like Lycoming County have a strict legal obligation to implement robust administrative, technical, and physical safeguards to protect sensitive personal information. Public entities that collect and store private data are required to maintain up-to-date encryption protocols, conduct regular vulnerability assessments, and secure network perimeters against unauthorized intrusion. The occurrence of a data breach of this magnitude strongly suggests potential failures in upholding these foundational security standards, raising serious questions about whether the county met its legal duties to safeguard the private information entrusted to its care.

For residents and employees who have received an official data breach notification letter from Lycoming County, this correspondence serves as formal legal acknowledgment that their private information was compromised due to the county's security failure. Legally, the receipt of this notice establishes the necessary foundation to participate in a class action lawsuit aimed at holding the administration accountable and securing appropriate compensation for the risks incurred. Plaintiffs in these actions do not need to prove that they have already suffered actual financial loss; the increased risk of future identity theft and the time and expense required to monitor one's credit are recognized harms. Our firm evaluates these cases on a contingency fee basis, meaning affected individuals pay no upfront costs and owe no legal fees unless we successfully recover compensation on their behalf.