Arc of Erie County
Disclosed Mar 9, 20188 years ago3,751 affectedSettled
Nonprofit exposed clients' sensitive data online for years; USD 200,000 NY AG penalty
The Buffalo nonprofit serving people with developmental disabilities left clients' sensitive personal information exposed on the internet for years. It paid a USD 200,000 penalty and agreed to a risk assessment.
What is known
| People affected | 3,751 (as reported to HHS) |
|---|---|
| Disclosed | Mar 9, 2018 |
| Attack | Exposed data |
| Data exposed | Names, Social Security numbers, Health, Other |
| Sector | Nonprofit · US |
| Status | Settled |
| Lawsuit or fine | USD 200,000 NY AG penalty (Aug 2018) (about $200K) |
Sources
| Source | |
|---|---|
| NY AG: USD 200,000 settlement with Buffalo nonprofitag.ny.gov · Regulator | Regulator |
| HHS OCR breach report (archive, resolved): Arc of Erie County (Healthcare Provider, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 9, 2018 | 3,751 |
| Researchtotal | Aug 29, 2018 |
History of this record
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 3751 · backfill source
- 2026-09-25 · disclosed: 2018-08-29 to 2018-03-09 · backfill source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.