Cahaba Center for Mental Health Data Breach 2025: 15,085 Affected · Hacking/IT Incident · AL. Filed With HHS OCR. What To Do.

Cahaba Center for Mental Health, a community mental health center based in Selma, Alabama, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on May 27, 2025, reporting 15,085 affected individuals in a Hacking/IT Incident involving an employee email account. The entity issued substitute public notice nearly ten months later, on March 9, 2026, describing the data elements potentially exposed and standing up a dedicated assistance line. Cahaba serves Dallas, Perry, and Wilcox counties and is part of Alabama’s network of community mental health centers (CMHCs).

Timeline

• January 22, 2025 — Earliest confirmed date of unauthorized access to a Cahaba employee email account, per the entity’s substitute notice.
• March 28, 2025 — Cahaba identifies suspicious activity in the employee email account and secures its email system, ending the access window.
• May 27, 2025 — Cahaba files the HIPAA breach notification with the HHS Office for Civil Rights. The federal record lists 15,085 affected individuals, the Hacking/IT Incident category, and Email as the location of the breached information.
• March 9, 2026 — Cahaba issues substitute public notice via PRNewswire, identifying the data elements involved and providing a dedicated assistance line at 1-833-757-5652 (Monday–Friday, 9:00 AM – 9:00 PM Eastern).
• March 2026 — Plaintiffs’ firms publicly announce class-action investigations into the breach. No filed complaint has been publicly indexed as of the date this page was last updated.

The gap between the HHS filing (May 2025) and the entity’s public substitute notice (March 2026) is unusually long for a breach of this size. The substitute notice does not explain the delay or specify when individual mailed notification letters were sent.

What was exposed

According to Cahaba’s substitute notice, the types of information present in the involved email account at the time of the unauthorized access included:

• Names
• Demographic information
• Patient identification and case numbers
• Dates of birth
• Medical diagnosis and treatment information
• Prescription information
• Driver’s license or state identification numbers
• Social Security numbers
• Financial account information
• Health insurance information
• Disability information
• Passport numbers

This is a broad combination. The pairing of Social Security number, driver’s license or state ID, financial account information, and passport number with clinical detail (diagnosis, treatment, prescriptions) is materially higher risk than a name-and-address-only breach, because the identity elements alone support new-account fraud and the clinical elements raise distinct privacy and stigma concerns.

Sensitive population: CMHC patients and the 42 CFR Part 2 question

Cahaba is a community mental health center. Its patient population includes people receiving care for mental illness, developmental disabilities, and (consistent with the role of Alabama CMHCs generally) substance use disorder treatment. Two layers of heightened sensitivity apply:

• Mental-health stigma and employability risk. Diagnosis and treatment information from a CMHC can affect insurance, employment, custody, and benefits determinations if disclosed. Patients in this population often face stigma costs that name-and-SSN-only breaches do not impose.
• Possible 42 CFR Part 2 coverage. Federal law (42 CFR Part 2) imposes stricter confidentiality and re-disclosure rules on records of patients in federally-assisted substance use disorder programs. The substitute notice does not say whether any of the affected records are Part 2 records, and the OCR portal entry does not address Part 2 status. If Part 2 records were included in the involved email account, the disclosure obligations and the legal-exposure profile are materially different from a standard HIPAA breach. Affected individuals who received SUD treatment from Cahaba may want to ask the entity directly whether their Part 2 records were among those in the involved mailbox.

We are flagging this as an open question rather than a confirmed fact. As of the lastUpdated date on this page, Cahaba has not publicly confirmed or denied 42 CFR Part 2 exposure.

Credit-monitoring offering

Cahaba’s substitute notice does not advertise a complimentary credit-monitoring or identity-protection package. Individual mailed notification letters in HIPAA breaches often offer credit monitoring even when the public substitute notice does not list it; affected individuals should read their mailed letter carefully and follow any enrollment instructions it contains. The dedicated assistance line is 1-833-757-5652, Monday through Friday, 9:00 AM – 9:00 PM Eastern.

Class-action posture

Plaintiffs’ firms have publicly opened class-action investigations into the breach. The investigation announced by Shamis & Gentile P.A. is the most visible of these. As of the lastUpdated date on this page, we have not located a filed class-action complaint or assigned court docket. We will update this section if and when a complaint is filed and a docket number becomes publicly available.

What to do if you may be affected

If you received care from Cahaba Center for Mental Health between January 22, 2025 and March 28, 2025, or if you receive a mailed notification letter:

• Read the letter carefully. It will list the specific data elements exposed for your record and any complimentary credit-monitoring offering. Note any enrollment deadline and any activation code.
• Freeze your credit with the three nationwide consumer reporting agencies (Equifax, Experian, TransUnion). It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity fraud given the SSN, driver’s license, and financial-account elements in this breach.
• If you have a passport number on file with Cahaba, review your passport status with the U.S. Department of State and watch for any unexpected passport-related correspondence.
• If you received substance use disorder treatment from Cahaba, consider calling 1-833-757-5652 to ask directly whether your 42 CFR Part 2 records were in the involved mailbox. This is not addressed in the public notice.
• Call the dedicated assistance line at 1-833-757-5652 (Monday–Friday, 9:00 AM – 9:00 PM Eastern) with questions about whether you were affected and what data elements applied to your record.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach (15,085 affected, Hacking/IT Incident, Email, filed May 27, 2025).
• Cahaba Center for Mental Health Provides Notice of Data Event (PRNewswire, March 9, 2026) — the entity’s official substitute notice, with the full data-element list and the dedicated assistance line.
• Cahaba Center for Mental Health Provides Notice of Data Event (Health Technology Net) — republication of the substitute notice.
• Cahaba Center for Mental Health Data Breach Investigation (ClaimDepot / Shamis & Gentile P.A.) — public class-action investigation page.
• Healthcare Data Breach Report for May 2025 (calHIPAA) — trade summary identifying Cahaba as one of the entities reporting in this filing window.
• Cahaba Center | Alabama Department of Mental Health — state directory entry confirming the entity’s CMHC role and Dallas/Perry/Wilcox county service area.