Internal working document. For Kelsie’s review before anything is approached.
Internal · not public copyFor: Kelsie Hart, Primary Hoosier Agent, Protect Indiana.org Status: internal working document, for your review before anything is approached. Prepared: 2026-08-30. Every figure below was read from the ledger, not estimated.
Indiana law requires an organization that loses Hoosiers' personal data to notify the Attorney General, and the AG publishes those filings year by year. We parse them into a ledger: 8,989 notices, 2014–2026, covering 10,088,526 Indiana-resident notices.
Two things about that number, because you will be asked:
notices. The ledger counts filings, not human beings, and we never present it otherwise.
every file it links to returns an error. It is recorded as a gap and has never been estimated or filled in.
Out of those 8,989 notices, three were selected for the first end-to-end run. The selection band was roughly 100 Indiana residents affected, which is deliberate: 784 filings in the ledger fall between 60 and 220 Indiana residents. That size is small enough that a single agent can work the whole case properly, and large enough that the organization took it seriously enough to file. A first run at 350,000 people would prove nothing except that we can't finish.
Each case below has a verified domain — checked 2026-08-30, not guessed. A wrong domain in a security conversation ends the conversation.
| Fact | Value |
|---|---|
| Indiana residents notified | 108 |
| National total in the filing | 108 |
| Indiana share | 100.00% |
| Incident date, per the filing | 2026-02-03 |
| Filed with the AG | 2026-02-09 |
| Domain | carmelclaylibrary.org (verified 2026-08-30) |
| Contact | 425 E. Main St, Carmel IN · (317) 814-3900 |
Who the affected people are: library patrons and/or staff in Carmel, Hamilton County. The filing does not say which, and the ledger does not carry a data-category field — see the caveat at the end of this section.
Why this is a credible conversation: every single affected person was a Hoosier, so there is no argument about whose problem this is. It is the most recent of the three — six days between the incident date and the filing, which is a fast, competent response and worth saying out loud to them. A public library is a small organization with a small domain, a public board, and a public duty of care to the people whose records it holds.
What to look for or ask:
city, or an outside firm? That answer tells you who you would actually be talking to.
standalone? That changes whose domain is even in scope.
| Fact | Value |
|---|---|
| Indiana residents notified | 112 |
| National total in the filing | 114 |
| Indiana share | 98.25% |
| Incident date, per the filing | 2025-03-03 |
| Filed with the AG | 2025-08-08 |
| Domain | agingihs.org (verified 2026-08-30) |
| Contact | 8101 W. Jefferson Blvd, Fort Wayne IN 46804 · (260) 745-1200 · info@agingihs.org |
Who the affected people are: clients of an Area Agency on Aging — older adults, people with disabilities, and family caregivers. This is the population that scam callers work hardest after an exposure, which is the entire reason this case is on the list.
Organizational detail — a non-profit operating since 1974, designated the Area Agency on Aging for nine northeast Indiana counties (Adams, Allen, DeKalb, Huntington, LaGrange, Noble, Steuben, Wells, Whitley) — comes from the organization's own public listings, not from the ledger. Re-confirm before using it in front of them.
Why this is a credible conversation: the harm here is not abstract. If the people in that filing start getting calls, the caller has a real name and a real service relationship to open with, and the target is the demographic least equipped to hang up.
What to look for or ask:
date of 2025-08-08.** That is a long interval. Do not lead with it, do not accuse anyone of anything, and do not assume it means a violation — discovery dates and incident dates are different things and the ledger holds only what was filed. But know it is there before you walk in.
follow an exposure? That is a gap we can fill for free, today, and it is the most honest opening we have.
| Fact | Value |
|---|---|
| Indiana residents notified | 96 |
| National total in the filing | 103 |
| Indiana share | 93.20% |
| Incident date, per the filing | 2014-05-01 (see anomaly below) |
| Filed with the AG | 2021-01-26 |
| Domain | yorktownindiana.org (verified 2026-08-30) |
| Contact | 9312 W. Smith St, Yorktown IN 47396 · (765) 759-8521 |
Who the affected people are: not stated in the filing. A town government holds records on employees, utility customers, and residents doing business with the town.
Why this is a credible conversation: Yorktown is in Delaware County — your assigned East Central territory, and the same county as the largest local finding in the whole ledger (Meridian Health Services Corp, 86,995 Indiana residents of 111,372 total, filed 2020). Local credibility is the asset here, not urgency.
Anomaly you must know about before using this case: the filing states an incident date of 2014-05-01 and a filing date of 2021-01-26. I checked this against the raw text of the AG's own 2021 report and it is not a parsing error on our side — that is what the report says. It could still be an error in the original filing. Treat the gap as unexplained, not as a finding. Do not characterize it publicly, and do not raise it as an accusation.
This is the oldest of the three by four years. Use it for territory relevance. Anyone who was affected has had a long time to be affected quietly.
| Filing | Indiana | National | Indiana share | Incident | Filed |
|---|---|---|---|---|---|
| First | 163 | 164 | 99.39% | 2026-02-04 | 2026-02-05 |
| Second | 142 | 150 | 94.67% | 2026-02-04 | 2026-03-10 |
Two separate 2026 filings from one small organization, both tracing to the same incident date, filed five weeks apart. That shape usually means the scope grew after the first filing.
Domain: not yet verified. Do not approach until it is.
This is a different demo from the other three: it shows a pattern rather than an incident, and it is the strongest illustration of why one filing is rarely the whole story. Hold it in reserve.
You will be asked how we know these are Indiana organizations. The honest answer is that our first attempt was wrong and we fixed it.
What failed: matching on names. Searching the ledger for Indiana-sounding names pulled in Wayne County Michigan, Boston Mutual, and Albany College of Pharmacy in New York. A name tells you what something is called, not where it lives.
What works: the ratio. Every filing carries two numbers — Indiana residents affected, and the national total. Divide the first by the second:
A national company that merely happened to notify some Hoosiers scores low. An Indiana organization's affected people are nearly all Hoosiers.
Carmel Clay Public Library is 108 of 108 — 100%. Aging & In-Home Services is 112 of 114 — 98.25%. Yorktown is 96 of 103 — 93.20%. Compare a national carrier in the same ledger, where the Indiana share is a small fraction of a multi-million-person total.
The ratio is combined with Indiana place names, school-corporation and local-government patterns, and the term REMC, which exists in Indiana and essentially nowhere else. Names are a supporting signal now, not the primary one.
Why this holds up under questioning: it is arithmetic on two numbers the organization itself reported to the Attorney General. We add nothing, infer nothing, and anyone can repeat it from the same public documents.
One honest limitation: where a filing carried no national figure, no ratio can be computed and the classification rests on name and type signals alone. Those cases are weaker and should be treated as such.
Read this section twice. It is the part that matters most.
organization published its own notice. All public record.
contact route. All public.
a domain check would tell the organization, and what they could do with the answer.
These three produce a complete, defensible case file with no permission required from anyone.
A domain search returns email addresses only after the service verifies that the person running the search is authorised to control that domain. That verification is the entire reason the mechanism is lawful.
We cannot run it on an organization's behalf until that organization authorises it. This is not caution and it is not policy preference — the check returns nothing without it. The organization unlocks this step. We do not.
Every outbound message on this estate is under a standing freeze. No email, letter, call, or approach to any of these organizations goes out without Adam's explicit, per-action approval. Preparing a case file is not approval to send it. If you are unsure whether something counts as outbound, it counts.
confirmed one.
when it has only been sent.
These are judgment calls a human agent should make. They are not decided.
Aging & In-Home Services has the strongest reason to care. Yorktown is in your territory. Only one of these gets to be the first impression.
people affected, or the domain check for the organization? Leading with the free thing is consistent with how Protect Indiana.org has always worked, and it is the easier conversation to have.
non-profit executive director, and a town clerk-treasurer are three completely different conversations. The published contact number is a starting point, not the answer.
August 2025) and Yorktown (a stated 2014 incident filed in 2021). Both are unexplained rather than damning. Silence, a private question, or nothing at all — your call, and it should be the same call for both.
unambiguously and early. It is a public record, it explains exactly how we know, and any alternative sounds like we know something we shouldn't.
illustration? Its domain is unverified either way.
Flagged rather than filled in:
carries organization, dates, and counts — no data-type field. This must come from each organization's own published notice and must not be assumed.
the ledger for any of the three.
a price to anyone until it is.
designation) — from the organization's public listings, not the ledger.
whether the original filing is correct is unknown.