Elmcrest Children’s Center confirms data breach after ransomware attack compromises sensitive information

Elmcrest Children’s Center, a Syracuse, New York-based nonprofit organization providing support services for children with emotional, behavioral, and developmental challenges, has disclosed a data breach following a ransomware attack that compromised sensitive personal and medical information.

According to the organization’s public notice, Elmcrest detected suspicious activity within its computer systems earlier this year. A subsequent investigation confirmed that its network was subject to unauthorized access between March 10 and July 24, 2025. During that period, a threat actor accessed and copied files containing confidential data.

While the full scope of the breach remains under review, preliminary findings indicate that the compromised information includes names, addresses, dates of birth, Social Security numbers, health insurance details, and medical information. Elmcrest has not yet confirmed how many individuals were affected, but the breach is believed to be significant due to the nature and volume of the data involved.

The Interlock ransomware group has claimed responsibility for the attack, asserting on a dark web forum that it obtained approximately 448 gigabytes of data, including more than 627,000 files. The group posted about the incident on August 4, 2025, alleging that the stolen data contains sensitive health and personal details belonging to children and their families.

Elmcrest has stated that it immediately initiated containment and mitigation efforts once the suspicious activity was detected. The organization engaged cybersecurity specialists to investigate the incident and enhance the security of its systems. Technical and administrative policies are being reviewed and updated to help prevent similar incidents in the future.

The organization also advised that it is continuing to assess the specific data elements involved and will notify affected individuals once the review is complete. Elmcrest emphasized that it takes the protection of personal and health information seriously and is cooperating with relevant authorities as the investigation continues.

Founded in 1845 as the Syracuse Orphans’ Asylum, Elmcrest Children’s Center today provides a broad range of residential, educational, and family support programs to thousands of children and families each year. Its services include residential treatment, Universal Pre-K, literacy programs, crisis support, and respite care.