Gateway Community Services, a leading addiction treatment provider, has experienced a major data breach. It has been reported that hackers gained access to the network on April 11, 2025 and both personally identifiable information (PII) and protected health information (PHI) may have been exposed.
The cybersecurity incident was reported to the U.S. Department of Health and Human Services (HHS) on May 29, 2025 and impacted individuals have been notified in writing. According to the official disclosure, the breach affected a total of 34,498 individuals in the United States.
An investigation took place and was completed on May 16, 2025. It was determined that the types of personal and protected health information exposed in the data breach may include names, addresses, dates of birth, Social Security numbers, drivers license numbers, medical treatment details, and health insurance information.
In addition to the Health and Human Services disclosure, Gateway Community Services, Inc. has also notified affected individuals.
If you believe your personal or protected health information may have been compromised in this breach:
For more information about the company, you can visit the Gateway Community Services website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.