Cornerstones of Care Data Breach 2025: 2,771 Youth and Family Records Exposed in Year-Long Email Account Compromise (Kansas City, MO)

Cornerstones of Care, a 150-year-old nonprofit headquartered in Kansas City, Missouri that provides foster care, adoption, residential treatment, in-home crisis intervention, and outpatient behavioral and mental health services to children and families across Missouri and Kansas, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on February 14, 2025, reporting 2,771 affected individuals in an unauthorized-access event at Email. The entity’s own notice, posted in late September 2025, traces the incident back to an unauthorized party that gained access to a limited number of employee email accounts in the fall of 2024 and confirms that forensic review of the impacted mailboxes was not completed until September 10, 2025. Notification letters began going out on September 30, 2025.

Timeline of what we know

• August 22, 2024. Cornerstones of Care learns that an unauthorized party may have obtained access to a limited number of employee email accounts. The organization reports the incident to law enforcement and engages third-party forensic professionals.
• September 10-11, 2024. Forensic investigators later determine that unauthorized access to the impacted email accounts occurred on or about these dates.
• February 14, 2025. Cornerstones of Care submits its HIPAA breach report to HHS OCR. The portal entry records 2,771 affected individuals, location of breached PHI listed as Email, with the type of breach categorized as an unauthorized access/disclosure incident.
• September 10, 2025. After a year-long forensic investigation and document review, Cornerstones of Care concludes that files containing protected health information and personally identifiable information stored in the impacted email accounts may have been subject to unauthorized access.
• September 30, 2025. Individual notification letters are mailed and a substitute notice is posted on the entity’s newsroom page. A dedicated toll-free response line - (877) 415-4305 - is activated, staffed 9:00 a.m. to 9:00 p.m. ET, Monday through Friday.

What was exposed

According to the substitute notice posted by Cornerstones of Care, the files in the impacted email accounts may have contained the following data elements, depending on the individual:

• Full name
• Home address
• Date of birth
• Social Security number
• Medical diagnosis and treatment information
• Health insurance information
• Provider information
• Medical Record Number
• Patient Account Number

Not every data element was present for every affected individual.

Why this exposure is especially sensitive: youth and behavioral health populations

Cornerstones of Care’s patient and client population is unusually concentrated on populations that draw heightened legal and ethical protection. Its programs include:

• Foster care and adoption services for children removed from their birth families, where the existence of a child welfare file is itself sensitive information.
• Residential treatment for youth ages 6-18 who have experienced trauma, abuse, or neglect, including the Kansas City area’s first Qualified Residential Treatment Program (QRTP).
• Outpatient mental health therapy and Functional Family Therapy (FFT) for at-risk children, families, and individuals.
• Intensive In-Home Services and Family Preservation Services - short-term crisis intervention programs for families at imminent risk of having children removed from the home, often involving allegations of substance use, abuse, or neglect.

When PHI for these populations is exposed, the downstream harms are not limited to financial fraud. They include stigma in school and community settings, complications in pending custody and dependency proceedings, retaliation in domestic situations, and chilling effects on a family’s willingness to engage with future behavioral health or child welfare services. To the extent any of the impacted records reference substance use disorder treatment received through a federally assisted program, those records are also subject to the stricter confidentiality protections of 42 CFR Part 2, which generally prohibits use or disclosure of patient identifying information in custody, employment, or criminal proceedings without specific written consent or a Part 2 court order.

What Cornerstones of Care is offering

Individuals whose Social Security numbers were contained in the impacted files have been offered complimentary credit monitoring at no cost. Cornerstones of Care has provided notified individuals with best-practice guidance for protecting their information, including reviewing explanation of benefits statements from health insurers and following up on any items they do not recognize.

For questions about the incident, Cornerstones of Care has established a dedicated toll-free response line at (877) 415-4305, available 9:00 a.m. to 9:00 p.m. ET, Monday through Friday, excluding holidays.

Class-action and regulatory posture

As of this writing, no class-action lawsuit appears to have been filed against Cornerstones of Care arising from this incident, and no plaintiffs’ firm has publicly announced an investigation. The breach record remains listed on the HHS Office for Civil Rights breach portal under the standard Breach Notification Rule review; no public OCR enforcement action has been announced. State attorney general filings, where required by Missouri, Kansas, and other states with affected residents, have not been publicly catalogued in a single location.

This breach is small in headcount relative to the largest healthcare breaches of 2025, but the combination of (a) youth and behavioral health populations, (b) a full Social Security number and medical-history exposure, and (c) a year-plus delay between detection and individual notification creates a meaningful liability exposure that is not yet reflected in the public docket.

What to do if you may be affected

If you, your child, or a family member received foster care, residential treatment, in-home crisis services, outpatient mental health therapy, or adoption services through Cornerstones of Care between roughly 2018 and 2024, you should assume you may be in scope and take the following steps.

1. Freeze your credit at all three bureaus. Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau online, and blocks new-account fraud. This is the single highest-leverage step when SSNs are in play.
2. If your child was a client, place a free child credit freeze. Each bureau offers a separate process for freezing a minor’s file. Children’s SSNs are uniquely attractive to identity thieves because they are rarely monitored and provide a clean slate for years.
3. Enroll in the complimentary credit monitoring if you receive an enrollment code in your notification letter. Letters were mailed starting September 30, 2025.
4. Request an Identity Protection PIN (IP PIN) from the IRS at irs.gov/ippin. It is free and prevents fraudulent federal returns under your SSN.
5. Review explanation of benefits statements from your health insurer, Medicaid, or CHIP plan. Report any services, providers, or dates of service you do not recognize to your insurer and to HHS OCR.
6. Be skeptical of unsolicited outreach. Threat actors often pair leaked names with targeted phishing referencing real provider relationships. Cornerstones of Care will not request your full SSN or banking details by phone to “verify” your file.
7. Call the dedicated response line at (877) 415-4305 if you have questions or believe you should have received a notification but have not.
8. Know your 42 CFR Part 2 rights. If any of your or your family’s substance use disorder treatment information surfaces in a custody, employment, criminal, or immigration matter, document it and consult a Missouri or Kansas healthcare-privacy attorney about Part 2 enforcement options.

Sources

• HHS Office for Civil Rights Breach Portal: the federal regulatory record of this breach, listing 2,771 affected individuals at Email (filed February 14, 2025).
• Cornerstones of Care: Notice of Data Security Incident: the entity’s substitute notice, including the detection date, forensic conclusion date, notification commencement, and the full list of data elements implicated.
• Cornerstones of Care: Youth and Family Support Services: description of the foster care, residential treatment, FFT, and in-home crisis intervention programs that drive the patient and client population in scope of this breach.
• Mental Health Providers Directory: Cornerstones of Care (Missouri): independent confirmation of the entity’s mental and behavioral health service lines and Missouri footprint.
• United Way of Greater Kansas City: Cornerstones of Care - Mental and Behavioral Health and Education Services: community confirmation of the entity’s behavioral health and education service profile in the Kansas City metro area.