Jefferson-Blount-St. Clair Mental Health Authority Data Breach 2026 (Medusa Ransomware): 30,434 Alabama Behavioral-Health Patients Exposed. 168 GB Stolen. No Credit Monitoring Offered. What To Do

What happened

Jefferson-Blount-St. Clair Mental Health Authority (JBS) is the Alabama Department of Mental Health-designated regional behavioral-health authority for Jefferson, Blount, and St. Clair counties (combined population >800,000). Headquartered in Birmingham, JBS operates four facilities and offers outpatient mental health, substance-use disorder treatment, intellectual-disability services, crisis intervention, vocational rehabilitation, case management, and residential programs (including the ProACT integrated MH/SUD program).

On November 25, 2025, JBS detected unauthorized network access, which forensic investigation later confirmed began the same day. On December 23, 2025, the Medusa ransomware group claimed responsibility on its dark-web leak site, asserting 168.6 GB of data had been exfiltrated and demanding $200,000 for destruction.

JBS filed with HHS OCR on January 23, 2026 confirming 30,434 affected patients and employees with records spanning 2011 to 2025 — roughly 15 years of retained data.

42 CFR Part 2 implications

Because JBS provides substance-use disorder treatment as part of its service mix, an undetermined portion of the affected records is likely protected under 42 CFR Part 2 in addition to HIPAA. Neither JBS’s substitute notice nor the HHS submission explicitly invokes Part 2.

What was stolen

• Full name, date of birth
• Social Security number
• Health insurance information
• Medical record number
• Diagnoses, physician / provider name
• Prescription / medication information
• Diagnostic and treatment information
• Medicare / Medicaid information
• Billing / claims data

What JBS is offering

No complimentary credit monitoring or identity-theft protection was offered, per Comparitech and HIPAA Journal reporting. Affected individuals are directed to monitor their own accounts and statements. This is uncommon for a 30,000-record HIPAA breach with full SSN exposure and likely to be a focal point of any class action.

What to do

1. Place free credit freezes at Equifax, Experian, and TransUnion. JBS is not providing monitoring.
2. File IRS Form 14039.
3. Exercise 42 CFR Part 2 rights if you received SUD treatment from JBS. Part 2 gives you stronger redisclosure restrictions than HIPAA alone.
4. Stop the ongoing flow of your behavioral-health data. HealthConsent files Part 2 redisclosure restrictions, HIPAA restriction requests, and state-law deletion requests so the mental health and substance-use treatment data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches