Research Foundation for Mental Hygiene, Inc., known as RFMH, has filed a data breach notice with the Massachusetts Attorney General. This page explains what the notice says, what it leaves out and what steps people can take.
Organizations that hold records tied to research and mental health programs have a particular responsibility to protect them.
Research Foundation for Mental Hygiene, Inc.’s Data Breach Investigation
Research Foundation for Mental Hygiene, Inc., which its letter calls RFMH, filed a sample notice letter with the Massachusetts Attorney General’s data breach notification list. The letter is headed Notice of Data Breach. In the filed copy the date, the recipient’s name and address, the enrollment link and the activation code are all blank, because it is a template rather than a letter sent to a specific person.
The letter says that it is written to tell recipients about an incident that may have involved some of their personal information. It says that on October 9, 2026, following a detailed review of the records, RFMH determined that the recipient’s personal information was involved. According to the letter, that information may have included the person’s name, address, phone number and Social Security number.
The letter does not describe the incident itself. It does not say what kind of event took place, when it began, how long it lasted or how it was discovered. It also does not say how many people were affected. Web searches for this page did not turn up a press release or news report that fills in those details, so this page does not guess at them.
RFMH says it has no evidence that any of the personal information has been misused in any manner, and that it is taking precautionary measures to help protect people’s financial security. According to the letter, upon discovering the incident RFMH immediately took steps to address the situation and engaged appropriate experts to help it conduct a full review of its security practices and systems, so that enhanced security protocols are in place going forward.
As part of its response, RFMH is offering single bureau credit monitoring, a single bureau credit report and a single bureau credit score at no charge. The letter says the service gives alerts for 24 months from the date of enrollment when changes occur to a person’s credit file, and that the alert is sent the same day the bureau makes a change or update. The service also includes proactive fraud assistance if a person becomes a victim of fraud. It is provided by Cyberscout, a TransUnion company, and the letter says people are not required to waive any rights or remedies to receive it.
The letter explains that people must enroll within 90 days of the date of the letter, that enrollment requires an internet connection and an email account, and that the service may not be available to people under 18. Recipients may be asked to verify personal information to confirm their identity. The letter says representatives are available for 90 days from the date of the letter, from 8:00 a.m. to 8:00 p.m. Eastern time, Monday through Friday, excluding holidays.
The letter encourages people to remain vigilant by reviewing account statements and monitoring their free credit reports. It describes how to place a fraud alert directly with Experian, Equifax or TransUnion, and explains the right to place a free security freeze, which prevents a consumer reporting agency from releasing information in a credit report without the person’s express authorization. To place a freeze, a person may be asked to provide a full name, Social Security number, date of birth, current and prior addresses and a copy of a government-issued identification.
People are urged to obtain free copies of their credit reports at annualcreditreport.com and to review them for suspicious activity, and to report suspected identity theft to local law enforcement, their State Attorney General or the Federal Trade Commission. The letter notes that recipients have the right to obtain a police report about the incident, and that victims of identity theft have the right to file a police report and obtain a copy. It also lists contact information for the Office of the Massachusetts Attorney General.
Because Social Security numbers are among the types of information the letter says may have been involved, people who receive a notice should take the offered protections seriously and keep a close watch on their credit. Federal and state laws require organizations to safeguard personal information and to notify people when it may have been exposed. Attorneys reviewing incidents like this one look at how the information was protected, how promptly people were told, and whether those affected may have legal options. This page relies only on the filed notice and may be updated as more information becomes available.
When Did This Breach Occur?
The notice says that on October 9, 2026, following a detailed review of the records, RFMH determined that personal information was involved. It does not say when the underlying incident occurred or when RFMH first discovered it, and the date of the letter is blank in the filed copy. Other dates are not publicly available at this time.
What Information Was Breached?
According to the notice, the personal information involved may have included names, addresses, phone numbers and Social Security numbers. The notice says the information varies by person and uses the words may have included, so the exact information involved for any one person is not confirmed. If you receive a notice, check it for the details that apply to you.
What You Can Do
If you received a notice related to Research Foundation for Mental Hygiene, Inc. or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Enroll in the 24 months of Cyberscout credit monitoring using the link and code in your letter, within 90 days of the date of the letter.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Research Foundation for Mental Hygiene, Inc.
If you received a notice from Research Foundation for Mental Hygiene, Inc., or you believe your personal information was exposed in this incident, you may have legal options. Whether you can seek compensation depends on the facts, and an attorney can explain whether you may be able to join a class action lawsuit over the exposure of your personal information.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
