Data breaches of those with minors' data (like the Eckerd Connects Data breach of December 2025) reveal a stark truth: breaches involving minorsvs are entirely different than breaches involving adults. Minors are unable to review their credit report, identify the misuse of their identity, and cannot advocate for themselves in the event of an unauthorized disclosure of their sensitive data—their potential consequences as a result of being unable to do so tend to be more irrevocable, more detrimental and ultimately will prove much more difficult to fix.
Why Children’s Data Carries Higher Long-Term Risk
The particular risk associated with minor's data is due to unique usage. From a cybersecurity and fraud perspective, the personal identification information of a minor (e.g.: social security number, medical record identifier (MRI), and educational records) may remain dormant for many years, leaving an accessible identity to the perpetrator for potentially lengthy periods of time. By the time any fraud is revealed (most commonly when trying to enter the workforce), the data trail will have become stale and the damage to the victim will have become deeply embedded in their history.
Another layer of permanence is added by both the medical and behavioral health histories of minors. Unlike a minor's financial history, the medical/mental health of a minor cannot be reset or replaced once disclosed. As a result, information of this type will be abused, misused or otherwise manipulated for possibly a lifetime.
Existing Laws Recognize the Sensitivity—but Gaps Remain
It is already known through existing laws (i.e., U.S. privacy and healthcare laws) that children’s data should have a higher level of protection. Current Frameworks (COPPA, HIPAA, and Consumer Privacy Statutes) impose higher duty on organizations that have to deal with children’s data by having consent of parents, particularly with regard to limiting collection of data and providing Data Security measures.
However, the experience of law enforcement has shown that enforcement of Compliance is generally not the same as providing Data Security; Organizational Practices relating to safeguard the data have been poorly implemented, primarily by organizations dealing with children, mostly due to a lack of Resources and/or limited Cybersecurity Staffing, Third Party Vendors, and, in particular, Outsourcing without sufficient oversight. Law Enforcement has increasingly been treating the lack of oversight as foreseeable risk rather than an acceptable standard.
Third-Party Vendors Multiply Exposure
Secondary exposure through Vendors are consistently identified as one of the most common forms of Data Breaches involving minors; i.e., customers of youth-serving organizations, youth-serving non-profits, and youth-serving (medical) services organizations, routinely share Youth Data with Vendors that help them manage their cases, advertise to them, bill them, and analyze their data.
Legally, Organizations maintain responsibilities for Vendor Security, even after the Vendor Agreement has been signed; Courts and Law Enforcement have continued to determine that organizations must perform proper Vendor Due Diligence, implement proper Access Controls, and limit Sharing to the Minimum Amount of Data Necessary when Children’s Data is included.
Why Standard Breach Responses Fall Short for Minors
The traditional tools designed to mitigate the effects of data breaches on individuals - such as credit monitoring or identity theft insurance - were intended for adult use and are ineffective or irrelevant for children. Children are unable to properly monitor their accounts and many parents do not realize how early exposure may impact children’s financial and legal status later in life.
Therefore, there has been an increasing level of scrutiny on whether there is an adequate response strategy that includes provisions for protecting the privacy and security of minors from data breaches, including extended protective measures, written guidelines for parents, and long-term protective measures in addition to short-term remediation.
The Expectations of Protecting Minors Are Shifting
There has been a significant increase in the number of data breaches impacting organizations that serve children, and as a result, the expectations of the organizations are shifting. It is not enough to simply provide protection of the information of minors after a data breach occurs; protection of minors' information must now include measures such as proactive development of security architecture, limited data retention, more robust vendor governance and incident response plans that take into account the unique risks that are posed to children.
The potential harm to an individual resulting from a breach of a child's personal data does not end with the notification of a breach; that harm can continue for decades. For this reason, breaches involving children should have a higher legal and security standard, not just as a recommendation for best practice, but as a baseline of responsibility.
