---
title: "Alma Family Services network incident"
description: "Alma Family Services notified employees after possible unauthorized network access discovered July 10, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-23"
canonical_url: "https://www.ally.security/incidents/alma-family-services-network-incident-2026"
markdown_url: "https://www.ally.security/incidents/alma-family-services-network-incident-2026.md"
stix_url: "https://www.ally.security/incidents/alma-family-services-network-incident-2026/stix.json"
---

# Alma Family Services network incident

Alma’s investigation could not determine whether specific employee information was accessed.

Last modified Oct 23, 2026 · 1 source

## Summary

- **Environment:** Alma Family Services network and employee records
- **Operational impact:** No operational outage quantified
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[Alma Family Services](https://www.almafamilyservices.org/) became aware of possible unauthorized network access on July 10, 2026. It activated its response procedures and later notified current and former employees. [1](#source-1)

## Impact

The investigation could not determine whether particular materials were accessed. The [employee notice](https://oag.ca.gov/system/files/Sample%20Notice%20Letters_0.pdf) identifies names but leaves additional fields unspecified. It does not establish patient exposure, confirmed theft or an affected-person total. [1](#source-1)

## Timeline

### July 10, 2026 — Possible access detected

Alma initiated incident response and secured systems. [1](#source-1)

### October 19, 2026 — Employee notice dated

Alma explained the uncertainty about access to employee information. [1](#source-1)

### October 23, 2026 — Briefing updated

This briefing was last reviewed and updated on October 23, 2026.

## Threat Group & Attack Vector

The notice does not establish an entry method or attacker identity. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Alma said it contained the incident, engaged cybersecurity experts and added safeguards and monitoring. It offered identity monitoring and restoration assistance to potentially affected people. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/alma-family-services-network-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Alma Family Services employee security incident notice

official · Alma Family Services · Oct 19, 2026

<https://oag.ca.gov/system/files/Sample%20Notice%20Letters_0.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Alma Family Services network incident: Alma notified potentially affected people and offered identity monitoring and restoration assistance.
2. **Resulted In · 100% confidence · current**  
   Alma Family Services network incident: Employee notification dated
3. **Resulted In · 100% confidence · current**  
   Alma Family Services network incident: Alma said it secured its systems, contained the incident, engaged cybersecurity experts and added monitoring and technical safeguards.
4. **Resulted In · 100% confidence · current**  
   Alma Family Services network incident: The notice identifies names but leaves the additional affected data fields unspecified.
5. **Occurred At · 100% confidence · current**  
   Employee notification dated: 2026-10-19
6. **Resulted In · 100% confidence · current**  
   Alma Family Services network incident: Possible unauthorized access detected
7. **Resulted In · 100% confidence · current**  
   Alma Family Services network incident: The employee notice concerns current and former staff information on affected servers; the investigation could not determine whether specific materials were accessed.
8. **Occurred At · 100% confidence · current**  
   Possible unauthorized access detected: 2026-07-10
9. **Affected Organization · 100% confidence · current**  
   Alma Family Services network incident: Alma Family Services
10. **Resulted In · 100% confidence · current**  
   Alma Family Services network incident: Alma became aware of possible unauthorized network access on July 10, 2026 and activated incident response.
11. **Discovered At · 100% confidence · current**  
   Alma Family Services network incident: 2026-07-10

</details>