Cornerstone Behavioral Healthcare, a mental health and substance use treatment center based in Bangor, Maine, has notified patients that a ransomware attack compromised sensitive personal and health information for tens of thousands of individuals. Health care providers that store Social Security numbers, insurance details, and records of substance use disorder treatment carry a heightened responsibility to protect that information from exactly this kind of attack.
Cornerstone Behavioral Healthcare’s Data Breach Investigation
On May 26, 2026, Cornerstone Behavioral Healthcare discovered that a ransomware attack had compromised the security of protected health information it maintains for patients. According to the notice Cornerstone issued under HIPAA’s Breach Notification Rule and Maine’s Notice of Risk to Personal Data Act, the ransomware attack began and was detected on the same day, and Cornerstone suspended the attackers’ access to its systems within about an hour of discovery. Cornerstone states it did not pay the ransom demanded by the attackers, and instead worked to shut down the affected computers and servers and restore its own electronic data. The organization estimates that less than 10 percent of the data stored on the affected systems may have actually been encrypted before it moved to contain the incident.
Cornerstone’s investigation initially identified that protected health information and personal information belonging to 2,830 individuals may have been compromised, including names, addresses, other contact information, dates of birth, health care information, substance use disorder treatment information, insurance and MaineCare information, and Social Security numbers. Then on July 22, 2026, Cornerstone’s continued investigation revealed a second, separate exposure: a log of appointment reminders covering an additional 12,000 individuals may have been viewed or accessed during the same ransomware attack. That log reportedly included patient names, dates of birth, appointment times, and reminders about documentation that was due, and Cornerstone said it was continuing to investigate whether any further personal or health information was involved for this second group. In total, federal reporting to the U.S. Department of Health and Human Services’ Office for Civil Rights lists 14,830 individuals as affected by this breach.
Ransomware attacks against behavioral health and substance use treatment providers have become increasingly common in recent years, in part because these organizations often hold an unusually sensitive combination of data, not just standard identifiers like names, addresses, and Social Security numbers, but detailed clinical records describing a patient’s mental health diagnoses and substance use disorder treatment history. That combination of financial and deeply personal medical information makes healthcare providers an attractive target for cybercriminals, since the same stolen data can be used both to commit conventional identity theft and, in some cases, to attempt to pressure or embarrass victims over sensitive treatment history.
When Social Security numbers are exposed alongside dates of birth, addresses, and insurance or MaineCare information, the risk extends well beyond routine identity theft. Criminals can use that combination to open new credit accounts, file fraudulent tax returns, or submit fake insurance claims in a victim’s name. Because substance use disorder treatment records carry additional privacy protections and personal significance, their exposure can also create a heightened risk of targeted phishing or social engineering attempts against affected patients, who may be contacted by someone falsely claiming to represent Cornerstone, an insurer, or a government agency.
Cornerstone’s notice indicates that it notified the Secretary of the U.S. Department of Health and Human Services of the incident in compliance with the HIPAA Breach Notification Rule at 45 C.F.R. Section 164.408, which generally requires covered entities to report breaches affecting 500 or more individuals to federal regulators, in addition to notifying the affected individuals directly and, in many cases, state regulators such as the Maine Attorney General’s office. The two-part disclosure timeline here, an initial notice covering 2,830 people followed by an expanded notice covering an additional 12,000 people after further investigation, is not unusual for ransomware incidents, where the full scope of what was accessed can take weeks or months to determine after the initial containment.
In response to the incident, Cornerstone Behavioral Healthcare says its leadership and information technology staff investigated the scope of the attack, restored the affected data, and wiped and replaced the compromised computers used by staff. The organization also reports that it reviewed its internal systems, policies, and procedures following the attack and implemented additional security measures, including extra layers of protection for its servers and specific staff training on recognizing and responding to ransomware threats.
When Did This Breach Occur?
Cornerstone Behavioral Healthcare says it discovered the ransomware attack on May 26, 2026, and moved to cut off the attackers’ access to its systems within about an hour of that discovery. Cornerstone’s investigation into the incident continued for weeks afterward: an initial review identified 2,830 individuals whose protected health information and personal information may have been compromised, while a second finding on July 22, 2026 identified an additional 12,000 individuals whose appointment-reminder information may also have been accessed. The breach was reported to the U.S. Department of Health and Human Services’ Office for Civil Rights with a submission date of July 27, 2026, listing a combined total of 14,830 affected individuals. Cornerstone has stated that it does not believe the ransomware attackers were able to access or encrypt more than a small fraction, less than 10 percent, of the data stored on the affected computers and servers before the attack was contained.
What Information Was Breached?
According to Cornerstone’s breach notification, the information that may have been compromised includes names, addresses, and other contact information, dates of birth, health care information, substance use disorder treatment information, insurance and MaineCare information, and Social Security numbers for an initial group of 2,830 patients. A second, separate exposure affecting an additional 12,000 individuals involved a log of appointment reminders that included patient names, dates of birth, appointment times, and reminders about documentation that was due. Cornerstone stated it was continuing to investigate whether any additional personal or health information was involved for this second group of individuals.
What You Can Do
Cornerstone Behavioral Healthcare has recommended that affected individuals take several steps to protect themselves. These include placing a fraud alert on your credit file with one of the three major credit bureaus, Equifax, Experian, or TransUnion, which will automatically notify the other two once one bureau confirms the alert. You should also request and carefully review copies of your credit reports for signs of unfamiliar accounts or activity, and continue monitoring your credit reports on an ongoing basis even after an initial review turns up nothing unusual. Closely watch your bank and other financial account statements, and contact your financial institution immediately if you notice any suspicious activity. Because Social Security numbers were involved, affected individuals may also want to consider placing a credit freeze with each bureau, and should watch for notices from the IRS about attempts to file a tax return using their information, using IRS Form 14039, the Identity Theft Affidavit, if a fraudulent return is discovered. Given that substance use disorder treatment information was also involved, patients should be especially alert to phishing emails, calls, or texts that reference their treatment history in an attempt to appear legitimate.
File a Data Breach Lawsuit Against Cornerstone Behavioral Healthcare
If your personal or health information was exposed in the Cornerstone Behavioral Healthcare data breach, you may be entitled to compensation. Companies and healthcare providers that collect and store sensitive information, including Social Security numbers and details about mental health and substance use disorder treatment, have a legal responsibility to keep that information secure. When that information is compromised in a ransomware attack, affected individuals can be left facing a lasting risk of identity theft, financial fraud, and the exposure of highly personal medical history.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
