Community Treatment Solutions Data Breach 2025: 950 Affected · Ransomware (Interlock) · NJ. Filed With HHS OCR. What To Do.

Community Treatment Solutions (CTS), an affiliate of Legacy Treatment Services headquartered in Hainesport, New Jersey, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on January 16, 2025, reporting 950 affected individuals in a Hacking/IT Incident at a Network Server. The CTS filing is a smaller, CTS-specific entry tied to a much larger underlying intrusion that hit the Legacy Treatment Services environment between October 6 and October 11, 2024, and ultimately resulted in notifications to 41,826 individuals across the combined Legacy / CTS patient and employee population.

The Interlock ransomware group publicly claimed responsibility shortly after the October 2024 intrusion and posted sample images of what it described as roughly 170 GB of exfiltrated data, including internal documents, patient records, and a large SQL database. Forensic analysts confirmed the scope of data acquisition on July 18, 2025, and the entity began mailing individual notification letters and posted a substitute notice on August 22, 2025.

Timeline

• October 6 to October 11, 2024 — unauthorized access to the Legacy / CTS network.
• October 11, 2024 — intrusion detected when network connectivity was disrupted. Interlock subsequently claimed responsibility.
• January 16, 2025 — CTS filed with HHS OCR (950 affected, Hacking/IT Incident, Network Server).
• July 18, 2025 — forensic confirmation that PHI was accessed and acquired.
• August 22, 2025 — individual notification letters and substitute notice published; complimentary credit monitoring and identity-theft protection (through IDX) offered for those with Social Security numbers exposed.

What was exposed

According to the entity’s own notice, the data elements involved include first and last names along with one or more of: Social Security numbers, dates of birth, driver’s license or state ID numbers, passport numbers, phone numbers, email addresses, financial account numbers, routing numbers, bank names, credit/debit card numbers (including CVV, expiration, PIN), login credentials, medical diagnoses, clinical information, treatment and procedure information, treatment locations, treatment cost information, provider names, medical record numbers, patient account numbers, health insurance information, prescription information, and biometric information.

That set is unusually broad. It pairs the financial-fraud trifecta (SSN + DOB + bank/card details) with deep clinical detail, which materially raises both the identity-theft and the privacy-harm exposure for affected individuals.

Why this one is more sensitive than most

Community Treatment Solutions provides clinically intensive, community-based services to children, youth, and families in South Jersey, including youth presenting with trauma, behavior, and addiction issues, as well as victims of human trafficking served through CTS’s BASE (Better Access for a Safe Environment) program. Its parent organization, Legacy Treatment Services, offers behavioral health, mental health, developmental, and addiction services across roughly ten locations in New Jersey.

That mission profile pulls this incident into the most sensitive corner of HIPAA-regulated data. Records that document mental-health diagnoses, addiction treatment, and services to minors and trafficking survivors carry stigma, custody, employment, immigration, and safety consequences that go well beyond typical financial-fraud exposure. Where the underlying records reflect treatment for substance use disorder, federal 42 CFR Part 2 confidentiality protections apply on top of HIPAA, and unauthorized acquisition of those records is exactly the harm Part 2 was written to prevent. Affected individuals and their guardians should assume that some of the most sensitive categories of their information may now be in the hands of a ransomware operator who has already published sample data.

What’s being offered

Legacy Treatment Services and CTS are offering complimentary credit monitoring and identity-theft protection through IDX to individuals whose Social Security numbers were potentially impacted. A dedicated response line is published in the entity’s notice. As with any post-breach offering, enrollment is time-limited — the entity has previously listed a November 20, 2025 enrollment deadline for the IDX services — and affected individuals should enroll promptly if they were offered coverage.

Class action and litigation status

At least one plaintiff’s firm (Edelson Lechtzin LLP) publicly announced an investigation on behalf of Legacy Treatment Services and Community Treatment Solutions customers in August 2025. ClassAction.org’s preliminary investigation has since closed without a filed complaint surfacing in public dockets at the time of this update. No certified class action has been confirmed against either entity as of this writing.

What to do if you may be affected

• Read your notification letter carefully. It lists the specific data elements exposed for your record, the credit-monitoring offer (if any), and the enrollment code and deadline. Notification letters under this incident began going out August 22, 2025.
• Enroll in the offered IDX credit-monitoring and identity-theft protection if your Social Security number was involved. Do this before the enrollment deadline in your letter.
• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account fraud — and it stacks on top of any monitoring offered.
• If a minor child received services from CTS, place a child-credit freeze with each bureau as well. Identity theft of minors typically goes undetected for years.
• If you received behavioral health or substance use treatment through CTS or Legacy, be aware that records covered by 42 CFR Part 2 may be implicated. You may have additional rights, including the ability to file a complaint with HHS OCR if you believe your records were improperly disclosed.
• Watch for targeted phishing and impersonation that references your treatment, your provider’s name, or your prescription information. The breadth of clinical detail in this dataset enables unusually convincing social-engineering attempts.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Legacy Treatment Services — Notice of Data Security Incident — the entity’s own substitute notice covering both Legacy and CTS.
• HIPAA Journal — Legacy Treatment Services Data Breach Affects 42,000 Individuals — trade-press summary of the combined Legacy / CTS incident.
• Comparitech — NJ social services org notifies 42K of data breach — independent reporting confirming the Interlock ransomware attribution and 170 GB exfiltration claim.
• ClassAction.org — Legacy Treatment Services investigation — plaintiff-side investigation status.
• Edelson Lechtzin LLP investigation notice — plaintiff-firm public investigation notice naming both entities.