Cornerstone Healthcare Data Breach: 14,830 Patients Exposed

Cornerstone Behavioral Healthcare, a Maine-based behavioral health provider offering mental health services and substance use disorder treatment, disclosed a data breach that affected approximately 14,830 individuals in the United States.

The breach was disclosed to the U.S. Department of Health and Human Services on July 27, 2026. Cornerstone Behavioral Healthcare posted a notice on its website.

On May 26, 2026, a ransomware attack was launched against Cornerstone Behavioral Healthcare's computer systems.

The company detected the attack on the same day it began and suspended the attackers' access to its systems within one hour. Cornerstone did not pay the ransom and was able to stop the encryption process and restore its electronic data.

Cornerstone believes that less than 10% of the data on the affected computers and servers may have been encrypted before staff were able to power them down. The company undertook an investigation of the incident to determine what information may have been compromised.

The initial investigation determined that the protected health information and personal information of 2,830 individuals may have been compromised as a result of the ransomware attack. The types of information exposed for these individuals included names, addresses, other contact information, dates of birth, health care information, substance use disorder treatment information, insurance and MaineCare information and Social Security numbers.

On July 22, 2026, Cornerstone's continued investigation revealed that a log of appointment reminders for an additional 12,000 individuals may also have been viewed or accessed during the attack. This log included patient names, dates of birth, appointment times and reminders of documentation due.

The company stated it was continuing to investigate whether any additional protected health information or personal information was involved for these 12,000 individuals.

Cornerstone Behavioral Healthcare's response to the breach

Affected individuals with questions about the incident can contact Cornerstone's Privacy Officer at 157 Park St., #5, Bangor, Maine 04401, by phone at 207-992-0410 or by email at privacyofficer@cornerstonebhc.com.