Clinica Family Health & Wellness Data Breach Affects 47,593 People, Exposing SSNs

On March 14, 2025, Clinica Family Health & Wellness discovered a data security incident affecting the Mental Health Partners environment, a system integrated into the organization following a recent merger.

The breach was the result of a ransomware attack carried out by the cybercriminal group INC RANSOM, who claimed responsibility and posted sample screenshots of stolen data on their dark web portal. While the forensic investigation did not uncover direct evidence that data was exfiltrated, the organization is conducting a comprehensive review to determine the full scope of information that may have been accessed by the unauthorized actor.

Clinica reported the breach to the U.S. Department of Health and Human Services on July 14, 2025, listing 47,593 people affected. However, the breach impacted some, but not all, of Clinica’s systems. The company noted that the Clinica Family Health Services system was not affected.

On Feb. 23, 2026, Clinica identified the people and the information that may have been affected. The data may have included full names, addresses, dates of birth, medical diagnosis or treatment information, health insurance information, Social Security numbers, driver’s license or other government ID numbers, financial information and other medical information.

INC RANSOM’s involvement underscores the severity of the breach. Ransomware attacks are particularly concerning in the healthcare sector due to the sensitivity of the data involved and the potential for operational disruption.

The incident has likely raised concerns among patients and staff, especially given the organization’s role in serving vulnerable populations. For more information, the official data security incident notice provides additional details.

Clinica Family Health & Wellness’s response

After detecting the intrusion, Clinica Family Health & Wellness contained the incident and engaged external cybersecurity professionals to assist with the investigation. The organization worked to identify all individuals whose information may have been impacted.

Clinica said it will send letters by U.S. mail to people who may have been affected and have a known mailing address.

To support those potentially affected, Clinica published precautionary measures on their website, including steps to protect against medical identity theft, instructions for placing fraud alerts or security freezes on credit files and guidance on obtaining free credit reports. The organization encouraged clients and personnel to consider these protective actions.

A dedicated and confidential toll-free response line was set up at 1-855-983-5736, staffed with professionals familiar with the incident and knowledgeable about steps to prevent misuse of information. The line is open Monday through Friday from 7 a.m. to 7 p.m. Mountain time, excluding holidays.

For more about the company, visit the Clinica Family Health & Wellness website.