Elmcrest Children's Center, a nonprofit organization in Syracuse, New York, providing residential, mental health, and special education services to children and families, has compromised and is exposing sensitive data, including names, birthdates, Social Security numbers, health insurance information, and medical records. This could result in consequences, including class action lawsuits and regulatory penalties under HIPAA and the New York State SHIELD Act (and potentially FERPA for school records), as well as reputational damage and the risk of identity theft.