Gandara Mental Health Center Data Breach Affects 20,024 People

On Oct. 24, 2024, Gandara Mental Health Center reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach may have affected about 17,543 people in Massachusetts and 20,024 people in total, according to the center's report to the U.S. Department of Health and Human Services.

Gandara said it found unusual activity in its network on June 20, 2024. Its investigation found that data was taken without permission on or about June 19, 2024. A review of the data ended Oct. 1, 2024, and notice letters were mailed Oct. 24, 2024.

The breach involved unauthorized access to a variety of sensitive data, including Social Security numbers and medical records. Such information is highly confidential and its exposure can lead to severe consequences for affected individuals, such as identity theft and financial fraud.

Information Exposed:

• Names
• Addresses
• Dates of birth
• Driver's license numbers
• Social Security numbers
• Medical treatment and diagnosis information
• Health insurance information
• Medical records

Gandara said not every type of data was involved for every person.

Gandara Mental Health Center's Response

In response to this breach, Gandara Mental Health Center has taken steps to mitigate the potential impact on affected individuals. They notified those whose information may have been compromised, offering them complimentary credit monitoring and identity theft protection services through Identity Defense. This includes 24 months of credit and identity monitoring, a $1,000,000 insurance reimbursement policy, and fully managed identity theft recovery services.

Additionally, Gandara has provided detailed instructions for individuals who wish to place a security freeze on their credit reports. This measure can help prevent unauthorized access to credit information. The deadline to enroll in these services was Jan. 22, 2025.

Steps for Affected Individuals

If you believe your information may have been compromised in this data breach, it is crucial to take immediate action to protect yourself. Here are some steps you should consider:

1. Credit Monitoring Offer: Gandara offered free Identity Defense services, but the enrollment deadline was Jan. 22, 2025.
2. Place a Security Freeze: Consider placing a security freeze on your credit reports with the three major credit bureaus: Equifax, Experian, and TransUnion. This will prevent new credit accounts from being opened in your name without your authorization.
3. Monitor Financial Accounts: Regularly check your bank and credit card statements for any unauthorized transactions. Report any suspicious activity immediately.
4. Obtain Your Credit Report: You are entitled to a free credit report from each of the three major credit reporting agencies annually. Visit Annual Credit Report to request your reports and review them for accuracy.
5. Stay Informed: Keep an eye out for any communications from Gandara Mental Health Center regarding updates or further instructions related to the breach.

For further details on the data breach disclosure, you can access the official document on the Massachusetts Office of Consumer Affairs and Business Regulation's website.

Update (Oct. 19, 2026): Gandara agreed to pay up to $900,000 to settle a class action lawsuit filed in Hampden County, Massachusetts, over the breach. The Gandara Mental Health Center settlement covers Massachusetts residents, and the claim deadline was July 23, 2026.