A document containing client names, Social Security numbers, addresses and birth dates was stolen from Community Teamwork’s Lowell, Massachusetts office in September 2026 by a service recipient. Although the document was recovered, the data may have been viewed during the roughly five days it was missing. Affected individuals should enroll in the free IDX identity protection offered before the February 2, 2027 deadline.
| Company | Community Teamwork, Inc. |
|---|---|
| Industry | Non-profit |
| Data Types Exposed | Full Names, Social Security Numbers, Home Addresses, Dates of Birth |
| People Affected | Not Publicly Disclosed |
| Attack Method | Physical Document Theft |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Community Teamwork Data Breach?
Community Teamwork, Inc., a social services organization based in Lowell, Massachusetts, has begun notifying clients about a physical document theft. The Community Teamwork data breach involved a paper record containing personal details that was taken from the organization’s office. This incident shows that data breaches are not always digital events.
According to the notification, the breach discovery date was September 2026, when a person receiving services from the organization removed a document from its premises. The document was later described as a beneficiary payout form. Staff identified the individual responsible and recovered the paperwork, but not before it had been out of the organization’s control for roughly five days.
Because the document was missing for several days, Community Teamwork could not rule out that someone viewed, copied or photographed it. As a result, the organization chose to notify everyone whose information may have appeared on the form. This cautious approach is common when paper records go missing, even after recovery.
Community Teamwork also reported the theft to law enforcement. The organization says it continues working with authorities as part of its response. Notification letters related to this incident went out in October 2026, consistent with the breach notification date already confirmed for this matter.
Who was affected?
The people affected by this breach are clients and beneficiaries of Community Teamwork’s programs. Because the organization serves low-income individuals and families in the Lowell area, those impacted likely include people who received benefits or other forms of assistance through the nonprofit.
The notification letter does not state how many people were affected. Therefore, the exact number of impacted clients has not been publicly disclosed. It remains unclear whether the stolen document held information belonging to a single client or several people at once.
Anyone who received a letter from Community Teamwork should assume their information was part of the exposed document. However, individuals who did not receive a notice should not assume they were involved. Given the organization’s client base, it is possible that vulnerable individuals, including families relying on benefit programs, are among those affected.
What Information Was Potentially Exposed?
The stolen document was described as a beneficiary payout form. These forms often combine identifying details with financial or benefit-related information, which is why the exposure raises real concern.
- Full names
- Social Security numbers
- Home addresses
- Dates of birth
The notice also indicates the exposed data may not be limited to these categories. Because of this, affected individuals should treat the full scope of their personal information as potentially at risk.
When a Social Security number is combined with a name, address and birth date, it becomes far easier for criminals to commit identity theft. For example, this combination is often enough to open new credit accounts or apply for loans in someone else’s name. Unlike a password, a Social Security number cannot simply be changed, so the exposure can create risk for years.
In addition, this type of information can be used to file fraudulent tax returns or wrongly claim government benefits. Because Community Teamwork serves people who may already rely on public assistance, fraudulent benefit claims could create particularly serious complications for victims. As a result, affected individuals should not dismiss this incident simply because it did not involve a hacker or malware.
What is the company doing?
Community Teamwork responded by apprehending the individual involved and recovering the stolen document. The organization then sent written notices to affected individuals in October 2026, explaining what happened and what information may have been involved.
In response to the incident, Community Teamwork is offering free identity protection services through IDX. This includes 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery support. The deadline to enroll in these services is February 2, 2027.
Beyond individual protections, the organization says it is strengthening physical security at its facilities. This includes relocating its Human Resources offices to a locked floor and redirecting security cameras toward that area. These steps suggest Community Teamwork is treating this as a physical security failure that needs structural fixes, not just a one-time incident.
The organization states there is no current evidence that the information has been misused. Even so, it chose to notify affected individuals and offer protective services as a precaution. This approach reflects an understanding that recovering a document does not guarantee its contents were never viewed.
What Should Affected Individuals Do?
Enroll in the Free Identity Protection Services
If you received a letter from Community Teamwork, it should include an enrollment code for IDX services. Because this protection is free, affected individuals should take advantage of it before the February 2, 2027 deadline.
These services include credit monitoring, dark web scanning through CyberScan, and recovery assistance if your identity is misused. Enrolling promptly ensures you have support in place in case suspicious activity appears later.
Place a Fraud Alert or Credit Freeze
Because Social Security numbers were involved, placing a fraud alert or credit freeze is a smart precaution. You can contact any one of Equifax, Experian or TransUnion to place a free fraud alert, which then applies across all three bureaus.
A credit freeze offers even stronger protection by restricting access to your credit file entirely. This makes it much harder for someone to open new accounts using your name and Social Security number. Both options are free and can be lifted later if needed.
Monitor Your Credit Reports and Accounts
You can request free credit reports at annualcreditreport.com and review them for unfamiliar accounts. Doing this regularly helps you catch fraudulent activity early, before it causes lasting damage.
In addition, check your existing bank and credit card statements for charges you do not recognize. Because identity thieves sometimes wait before using stolen information, ongoing vigilance matters even months after a breach notice arrives.
Watch for Signs of Benefit or Tax Fraud
Since the stolen document was described as a beneficiary payout form, watch closely for unexpected denials of benefits or odd account changes. This could indicate someone attempted to use your information fraudulently.
Similarly, pay attention to unexpected tax notices or IRS correspondence about returns you did not file. If you notice anything unusual, report it immediately to the relevant agency and to the Federal Trade Commission at identitytheft.gov.
Stay Alert for Phishing Attempts
After a breach notification, scammers sometimes pose as the breached organization or a credit monitoring service to steal more information. Be cautious of unexpected calls, texts or emails asking you to confirm personal details.
Instead, contact Community Teamwork or IDX directly using the phone number printed in your official letter. This ensures you are speaking with a verified representative rather than someone attempting to exploit the breach.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.