Balance Autism Agrees to Pay Up to $290,000 Over Data Breach

From Intrusion to Settlement

ALTOONA, IOWA – Balance Autism has agreed to pay up to $290,000 to settle Bennett v. Balance Autism, a class action following a network breach in March 2025. The Iowa District Court for Polk County will decide on final approval at a hearing set for June 12.

The breach was brief. From March 11 to March 17, 2025, intruders accessed Balance Autism’s systems and could see names, birth dates, Social Security numbers, health insurance details, and Medicaid numbers, according to The HIPAA Journal. The organization told the HHS Office for Civil Rights (OCR) that 1,281 people were affected.

Balance Autism finished reviewing the compromised data by May 5, 2025, and began sending notification letters. On May 20, Strauss Borrelli PLLC, a Chicago law firm, announced an investigation. Plaintiff Andrea Bennett’s complaint, filed January 30, 2026, alleged negligence, breach of good faith, unjust enrichment, breach of fiduciary duty, and invasion of privacy. The settlement received preliminary approval. Balance Autism denies any fault, wrongdoing, or liability. The mediated settlement does not mean the organization admits liability.

What the Settlement Pays

Class members can claim up to $400 for documented out-of-pocket losses, including up to four hours of lost time at $20 per hour. If they suffered actual fraud or identity theft after March 11, 2025, they can claim up to $4,000. Alternatively, members can take an estimated $50 cash payment. Anyone with a valid claim gets two years of credit monitoring with at least $1 million in fraud insurance. If total approved claims exceed $290,000, each payment will be reduced proportionally.

The defendant’s costs exceed the $290,000 cap. Class counsel is asking for up to $125,000 in fees, costs, and expenses, plus a service award of up to $2,500 for Bennett. Balance Autism will pay these amounts in addition to the class benefits. The organization will also cover settlement administration and agreed security upgrades separately.

The class settlement cap is $290,000. The fee request, service award, administration, and security upgrades are not included in this cap.

Balance Autism is a 501(c)(3) nonprofit that began in 1994 as The Homestead. It serves over 300 children and about 150 adults each year, has a $21 million operating budget, and employs more than 400 people at nine locations in Iowa.

One settlement term is specific to autism care: a legal guardian can file a Minor Claim Form to recover extraordinary losses on behalf of a child. Most of the organization’s clients are children, and the exposed records included Medicaid and Social Security numbers.

A Second Incident in Nebraska

Around June 15, 2026, someone used stolen credentials to log in to the QuickBooks Online account of Wabi Sabi Behavioral Health Center, a multidisciplinary clinic in Hastings, Nebraska, offering ABA services. The credentials were linked to a third-party account with authorized access. The clinic discovered the breach on June 15 after noticing unauthorized changes to payroll. According to The HIPAA Journal, the attack aimed to divert employee pay to accounts controlled by the attacker.

Only employee data was exposed, not patient data. The intruder accessed payroll records with staff names, addresses, and Social Security numbers. Wabi Sabi secured the accounts, worked with Intuit to investigate, and notified employees on June 25. The clinic is offering 12 months of Kroll identity monitoring, with enrollment open until September 30. The clinic says it has found no evidence of misuse and has not shared how many employees were affected.

Despite this, claim solicitation started. By mid-July, the claims-aggregation site ClaimDepot listed the incident as a lawsuit investigation and told affected employees that lawyers are reviewing the case for a possible class action.• • •

Three More Behavioral Health Breaches

These two incidents happened during a period of even larger behavioral health data breaches. North Texas Behavioral Health Authority in Dallas reported a breach affecting about 285,000 people (285,086 in its OCR filing), which Becker’s Behavioral Health called the sixth-largest reported to OCR in 2026 as of April. Intruders accessed its network from October 13 to 15, 2025. Richmond Behavioral Health Authority in Virginia reported a ransomware attack that affected up to 113,000 people. The Qilin ransomware group claimed responsibility and said it published 192 GB of stolen data. In March, Qilin also claimed an attack on Aroostook Mental Health Center, a rural Maine provider with over 5,500 clients. According to the Bangor Daily News, the center said the data posting happened after it refused to negotiate.

None of these three organizations is an ABA company, but the breaches in Texas and Virginia exposed Social Security numbers, and Richmond’s breach also included health information. The Bennett case shows what can happen when similar files belong to an autism provider: a law firm investigation is announced within weeks, and a complaint is filed with a settlement already negotiated. The Wabi Sabi case shows that a breach can happen even with something as simple as compromised third-party credentials on a cloud accounting tool.

At the time of publication, the settlement website’s case documents page ends with an April 17 fee brief and does not list a final approval order. Payments to the Balance Autism class will start only after the court gives final approval and any appeals are resolved. Wabi Sabi employees have until September 30 to sign up for identity monitoring, which wraps up the Nebraska case.

AT A GLANCE

SOURCES & REFERENCES