Counseling Center of Wayne & Holmes Counties Data Breach 2026: 83,354 Ohio Behavioral-Health Patients Exposed. 42 CFR Part 2 Records Likely in Scope. What To Do

What happened

The Counseling Center of Wayne & Holmes Counties (CCWHC) is a community behavioral-health agency headquartered in Wooster, Ohio, serving rural Wayne and Holmes counties with four locations across northeast Ohio. It provides mental-health counseling and addiction / substance-use treatment.

On March 2, 2025, an unauthorized actor accessed a CCWHC server. On March 3, 2025, a third-party service provider (presumably the agency’s IT vendor or MSP) alerted CCWHC to suspicious activity and system disruption. Containment began the same day.

The forensic review took nine months. On December 9, 2025, the review concluded that the unauthorized actor had likely exfiltrated patient data. CCWHC posted a substitute notice dated January 29, 2026 to ccwhc.org, filed with the HHS Office for Civil Rights and began mailing individual notification letters on February 9, 2026, and filed with the Maine AG and Massachusetts Office of Consumer Affairs the same day. The OCR filing confirmed 83,354 affected individuals.

No ransomware group has publicly claimed responsibility for CCWHC. Earlier HIPAA Journal bundled coverage tied the Sinobi group to a separate Pecan Tree Dental incident in the same article; that attribution does not apply to CCWHC.

42 CFR Part 2 implications

Because CCWHC provides community behavioral-health and substance-use treatment, a meaningful portion of the 83,354 affected individuals’ records is likely protected under 42 CFR Part 2 in addition to HIPAA. Part 2 records receive stricter federal protection than HIPAA records, including more restrictive redisclosure rules. CCWHC’s public notice does not explicitly address Part 2 status.

What was stolen

Per CCWHC’s notice (verbatim categories):

• Full name, date of birth
• Social Security number
• Driver’s license or state ID number
• Health insurance information
• Medical condition information
• Treatment provider name
• Medical record number
• Treatment cost information
• Diagnosis and / or treatment information

What CCWHC is offering

CCWHC’s public substitute notice does not enumerate a credit-monitoring product, enrollment code, vendor, or duration. Strauss Borrelli’s writeup references “complimentary credit monitoring services” being offered, but the public notice’s only response guidance is self-help (annual free credit reports, fraud alerts, security freezes, FTC and state AG contacts). Mailed letters may include enrollment offers not in the public web notice — read your specific letter carefully.

What to do

1. Place free credit freezes at Equifax, Experian, and TransUnion. Full SSN + driver’s license combination is in scope.
2. File IRS Form 14039 to prevent fraudulent tax filings.
3. Be alert to phishing. Stigma-targeted scams referencing behavioral-health or substance-use treatment are realistic given the dataset.
4. Exercise 42 CFR Part 2 rights if you received SUD treatment from CCWHC. Part 2 gives you stronger redisclosure restrictions than HIPAA alone.
5. Stop the ongoing flow of your behavioral-health data. HealthConsent files Part 2 redisclosure restrictions, HIPAA restriction requests, and state-law deletion requests so the SUD and mental-health treatment data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches