How do I know if I am affected by the High Point Treatment Center, Inc. data breach?

High Point Treatment Center, Inc. is mailing notification letters directly to affected individuals. If you have received care or services from High Point Treatment Center, Inc. (also operating as HPTC) in the period leading up to January 2026 and you have not received a letter, contact the entity directly. 25,832 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the High Point Treatment Center, Inc. breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Social Security number, Date of birth, Home address, Government ID, Medical diagnosis and treatment information, Treatment dates and locations, Treating clinician names, Health insurance ID and group numbers.

Was High Point Treatment Center, Inc. attacked by a ransomware group?

Yes — the Abyss Ransomware-as-a-service group (double-extortion) claimed responsibility for the attack on High Point Treatment Center, Inc..

What is HealthConsent and how does it help with the High Point Treatment Center, Inc. breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by High Point Treatment Center, Inc. addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker New Bedford, MA HQ Disclosed January 30, 2026

High Point Treatment Center Data Breach 2026 (Abyss Ransomware): 25,832 Massachusetts SUD Patients Exposed. 1.8 TB Stolen. 42 CFR Part 2 Records Likely in Scope. What To Do

Q: Should I file a lawsuit over the High Point Treatment Center, Inc. data breach?

4 plaintiffs' firms have publicly announced investigations or filed complaints related to the High Point Treatment Center, Inc. breach: Federman & Sherwood (publicly investigating), The Lyon Firm (publicly investigating), Strauss Borrelli (publicly investigating), Srourian Law (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

High Point Treatment Center, a Massachusetts substance-use-disorder and behavioral-health nonprofit operating since 1996, disclosed a 2025 Abyss ransomware attack that exfiltrated approximately 1.8 TB of patient and employee records. Updated to HHS OCR in January 2026 at 25,832 affected. 24 months Cyberscout monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Jun 17, 2025

Unauthorized access window begins (network server / EMR)

Jul 6, 2025

Unusual activity detected

Jul 16, 2025

Breach formally discovered

Jul 16, 2025

Breach detected

Jul 26, 2025

Abyss group lists High Point on leak site (1.8 TB claimed)

Jul 29, 2025

Initial notifications mailed (employment-context records, 4,613 affected)

Jan 30, 2026

Updated HHS OCR filing (25,832 affected including patient PHI)

Mar 1, 2026

Updated Notice of Data Event posted to hptc.org

Data exposed

High-risk identity

Enables financial + identity theft

Social Security number Date of birth Government ID

Health records

Don't expire and can't be reissued

Medical diagnosis and treatment information Treatment dates and locations

Contact & insurance

Phishing + targeted scams

Full name Home address Treating clinician names Health insurance ID and group numbers

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Federman & Sherwood (publicly investigating) The Lyon Firm (publicly investigating) Strauss Borrelli (publicly investigating) Srourian Law (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

High Point Treatment Center, Inc. (HPTC) is a Massachusetts nonprofit founded in 1996, headquartered at 72 Kilburn Street, New Bedford, MA, with main campuses in Brockton, New Bedford, and Plymouth. HPTC is an outpatient and residential substance-use-disorder (SUD) and behavioral-health provider, Joint Commission accredited, and operates as a 42 CFR Part 2 program for SUD treatment records.

Between June 17 and July 7, 2025, an unauthorized third party accessed HPTC’s network server and EMR system. Unusual activity was detected on July 6, 2025; the breach was formally discovered on July 16, 2025. Forensic review concluded the next day that data had been viewed and copied. On July 26, 2025, the Abyss ransomware group listed HPTC on its dark-web leak site, claiming approximately 1.8 TB of exfiltrated data.

The initial notification on July 29, 2025 covered 4,613 affected — employment and prospective-employment records identified at that stage. After additional review identified patient PHI in the exfiltrated dataset, the HHS OCR filing was updated on January 30, 2026 to 25,832 affected. An updated public Notice of Data Event was posted to hptc.org in March 2026.

42 CFR Part 2 implications

Because HPTC operates as a federally assisted SUD treatment program, the affected patient records include 42 CFR Part 2-protected substance-use treatment records. Part 2 imposes substantially stricter redisclosure rules than HIPAA. The HHS Part 2 enforcement program took effect February 16, 2026, placing this incident in the first cohort subject to dual HIPAA + Part 2 enforcement.

What was stolen

Full name, date of birth, home address
Social Security number
Government ID
Medical diagnosis and treatment information
Treatment dates and locations
Treating clinician names
Health insurance ID and group numbers

Given HPTC’s service mix, the treatment-related fields include SUD-specific records (detoxification, methadone maintenance, residential treatment placement, MOUD prescriptions).

What HPTC is offering

24 months of complimentary single-bureau credit monitoring, credit reports, and credit-score services through Cyberscout (TransUnion)
Dedicated assistance line: 833-397-4692 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)
90-day enrollment window

State AG filings: Maine AG (4 residents, filed July 29, 2025), Massachusetts AG (July 2025), New Hampshire AG (15 residents, filed Aug 5, 2025).

What to do

Enroll in Cyberscout through the activation code in your letter.
Place free credit freezes at all three bureaus.
Exercise 42 CFR Part 2 rights. As an HPTC patient, your SUD treatment records receive heightened federal protection. Part 2 gives you stronger redisclosure restrictions than HIPAA alone — relevant if you observe your treatment history surfacing in unauthorized contexts.
File IRS Form 14039.
Stop the ongoing flow of your SUD treatment data. HealthConsent files Part 2 redisclosure restrictions, HIPAA restriction requests, and state-law deletion requests across providers, insurers, and downstream entities.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.