Programs for Parents, Inc. Data Breach

Booba Project listed Programs for Parents, Inc. on its leak site on October 29, 2026. The organization is a US-based nonprofit providing family support, early childhood education, and social services to low-income families and children, and it operates the domain programsforparents[.]org. As a mission-driven social services provider, the organization handles sensitive information about the families it serves, which makes the alleged listing notable for a sector that is often assumed to sit outside the typical ransomware targeting profile. The listing was observed on the group’s leak site, and the claim should be treated as alleged until independently confirmed. Booba Project has listed 32 victims in the past 60 days, with its activity concentrated in the United States, Canada, and Pakistan. Community foundations, government agencies, social services providers, and educational institutions all appear among its recent listings, and the group does not exclude mission-driven organizations from its targeting. Programs for Parents, Inc. fits this pattern closely: it is a US-based social services and early childhood education provider, directly overlapping both the group’s leading victim geography and the nonprofit and social services sectors that recur in its recent claims.

Two infostealer records tied to programsforparents[.]org surfaced between December 2025 and April 2026, and both are associated with Constant Contact, the email marketing and community communications platform widely used by nonprofits. Compromised Constant Contact credentials give an adversary access to donor contact databases, volunteer coordination lists, and communications histories. For a social services organization, that data includes information about the families it serves, which raises the sensitivity of the exposure beyond ordinary marketing contact lists. The records indicate credential theft through an infostealer infection rather than a confirmed intrusion into the organization’s own systems. The Constant Contact exposure is notable because it is a third-party SaaS credential — the kind of harvest that occurs on a staff member’s personal device and does not require touching the organization’s own infrastructure. Nonprofits with limited security resources are systematically exposed through the SaaS tools they rely on for outreach, and this listing fits that pattern. The presence of these records does not confirm that the group’s leak-site claim stems from this access path, and credential exposure alone does not establish that a ransomware deployment occurred; however, harvested SaaS credentials could support further account access or be validated and resold, and the absence of records tied to the organization’s corporate domain would not rule out compromise. Continued dark web and stealer-log monitoring, proactive credential-hygiene checks including rotation of the affected Constant Contact credentials, and review of access to third-party communications platforms are warranted given the observed exposure.