New Horizons Data Breach Exposes Sensitive PHI and PII of Employees

New Horizons Behavioral Health, a community mental health care provider headquartered in Columbus, Georgia, disclosed a data breach after discovering suspicious activity on its computer network in January 2026.

The organization posted a notice on its website on March 18, 2026, alerting the public to the incident. According to the notice, New Horizons discovered the breach on Jan. 18, 2026, and is still conducting a review to identify all affected individuals.

The organization stated it plans to mail written notification letters to potentially affected individuals for whom it can locate an address once that review is complete.

What happened in the New Horizons Behavioral Health data breach

On Jan. 18, 2026, New Horizons Behavioral Health observed suspicious activity on its computer network, according to the company's notification. The organization stated it launched an investigation to determine the nature and scope of the activity.

The investigation determined that an unauthorized actor gained access to the organization's network between Jan. 15 and Jan. 18, 2026.

Following the discovery, New Horizons began review of the impacted files to identify the individuals whose information may have been included, according to the company's notification. The organization stated it is working with the assistance of third-party subject matter specialists, but that review remains ongoing as of the date of the notice.

The breach exposed both personally identifiable information and protected health information. The personally identifiable information found in the affected files included names, addresses, dates of birth, Social Security numbers, driver's license numbers and financial account information.

The protected health information exposed included prescription information, treatment location and details, medical diagnoses, medical record numbers, provider names, health insurance policy information and identification numbers.

New Horizons Behavioral Health's response to the breach

New Horizons engaged third-party subject matter specialists to assist with its ongoing review of the affected files.

The organization also stated it would attempt to locate address information for all potentially affected individuals so it could proceed with written notification.

New Horizons stated it will offer complimentary credit monitoring to all individuals who receive notification letters once its review of the affected files is complete. Enrollment details and instructions will be included in those written notifications when they are mailed to affected individuals.

Individuals who have questions about the incident can contact New Horizons Behavioral Health's dedicated toll-free assistance line at 1-800-405-6108. The line is available Monday through Friday from 8 a.m. to 8 p.m. Eastern time, excluding holidays.

Affected individuals may also write to the organization at 2100 Comer Ave., Columbus, GA 31906.

Steps to take if your information was exposed

• Place a fraud alert or credit freeze with all three credit bureaus. Contact Equifax (1-800-525-6285), Experian (1-888-397-3742) and TransUnion (1-800-680-7289) to help prevent unauthorized accounts from being opened.
• Review credit reports for unfamiliar activity. Free credit reports are available at AnnualCreditReport.com and should be checked for any accounts or inquiries that are not recognized.
• Monitor bank and financial account statements closely. Watch for unauthorized transactions and report any suspicious activity to financial institutions right away.
• Review Explanation of Benefits statements from health insurers. Check for medical services or prescriptions not received, which could be a sign of medical identity theft.
• Consider filing a report with the FTC if identity theft is suspected. The Federal Trade Commission can be reached at identitytheft.gov or by calling 1-877-438-4338.
• Be cautious of phishing attempts that reference this breach by name. Scammers may send emails, texts or phone calls mentioning New Horizons Behavioral Health in an attempt to collect additional personal information.