Cahaba Mental Health Data Breach Exposes Social Security Numbers

On May 27, 2025, Cahaba Center for Mental Health disclosed a data breach to the U.S. Department of Health and Human Services that impacted 501 individuals in the United States. The breach involved unauthorized access to an employee’s email account on separate occasions between Jan. 22, 2025, and March 28, 2025.

According to the website notice, the suspicious activity was first identified on March 28, 2025, prompting the organization to secure its email system and launch a thorough investigation.

The exposed data included both personally identifiable information (PII) and protected health information (PHI): names, demographic information, patient identification and case numbers, dates of birth, medical diagnosis and treatment information, prescription information, driver’s license or state identification numbers, Social Security numbers, financial account information, health insurance information, disability information and passport numbers.

While the investigation could not confirm whether this information was actually accessed or misused, the possibility could not be ruled out.

Cahaba Center for Mental Health’s response

Cahaba Center has implemented additional safeguards and is reviewing its existing policies and procedures to help prevent similar incidents in the future. A dedicated assistance line has been established at 833-757-5652, available Monday through Friday from 9 a.m. to 9 p.m. Eastern Time, for individuals seeking more information or to confirm whether their information was involved.

Those potentially affected are encouraged to remain vigilant by reviewing account statements, explanation of benefits statements and monitoring free credit reports for suspicious activity. The organization’s notice also provides detailed instructions on how to request free credit reports, place fraud alerts or credit freezes with the three major credit bureaus, and report suspected identity theft to the appropriate authorities.

Additional information about the breach can be found on the U.S. Department of Health and Human Services breach portal.