Johnson County Park and Recreation District Data Breach Lawsuit Investigation

Johnson County Park and Recreation District customers who purchased Theatre in the Park tickets between March 13 and September 30 2025 are being notified that payment information may have been exposed during checkout. If you received a breach letter, learn how to protect yourself and see whether you can participate in a potential lawsuit.

Key Details of the Johnson County Park and Recreation District Breach

• Breach window: March 13 2025 – September 30 2025
• Discovery date: September 30 2025
• Consumer notices issued: November 11 2025
• Affected platform: Theatre in the Park online box-office checkout page (hosted by Skyway Networks)
• Data involved: name, credit-card number, expiration date, and CVV code
• Free services offered: complimentary credit-monitoring and identity-protection services

What Happened

Skyway Networks, the third-party provider that hosts the Johnson County Park and Recreation District (“JCPRD”) Theatre in the Park ticketing site, detected unusual activity on September 30 2025. JCPRD and Skyway launched an investigation and discovered that unauthorized code had been injected into the checkout page. The code was capable of capturing payment information entered during transactions conducted between March 13 and September 30 2025.

Information Exposed

The investigation determined that the following data may have been captured at the time of purchase:

• Name
• Credit-card number
• Card expiration date
• CVV security code

Response Measures

According to the notice, Skyway Networks reset relevant account passwords and added new security features aimed at preventing a similar incident. JCPRD performed a full review of transaction data to identify potentially affected individuals and is providing complimentary credit-monitoring and identity-protection services.

Recommended Next Steps for Impacted Consumers

• Review recent and future credit-card statements for unfamiliar charges.
• Report unauthorized transactions to your card issuer immediately.
• Enroll in the free credit-monitoring and identity-protection services offered in the notification letter.

Company Overview

• Website: jcprd.com
• Headquarters: 7900 Renner Rd., Shawnee Mission, KS, USA
• Year founded: 1953
• Industry: Parks, recreation, and cultural programs

Frequently Asked Questions

I received a data breach letter from Johnson County Park and Recreation District — what should I do?

Follow the instructions in the letter: monitor your credit-card statements, enroll in the complimentary credit-monitoring service, and promptly dispute any unauthorized charges with your card issuer.

How do I submit a claim related to the Johnson County Park and Recreation District data breach?

If you experienced fraudulent charges or other losses linked to this incident, keep detailed records of the impact and consult an attorney to discuss eligibility for a lawsuit or reimbursement.

Am I eligible to join a lawsuit against Johnson County Park and Recreation District?

Eligibility generally depends on whether your personal information was involved and whether you suffered financial or time losses. Contact a data-breach attorney to evaluate your specific situation.

What information did the Johnson County Park and Recreation District breach expose?

Potentially exposed data includes your name, credit-card number, expiration date, and CVV code entered during Theatre in the Park ticket purchases between March 13 and September 30 2025.

Did Johnson County Park and Recreation District offer credit monitoring?

Yes. The organization is providing complimentary credit-monitoring and identity-protection services to everyone notified.

How can I get the official breach notice (PDF) for Johnson County Park and Recreation District?

You can download it directly from the Vermont Attorney General’s website using the button above or the link in the Sources sidebar.