Ransomware Attack at Cornerstone Behavioral Healthcare May Have Exposed Data of 14,830 People
Summary
Cornerstone Behavioral Healthcare says a May 2026 ransomware attack may have exposed personal and health information belonging to about 14,830 people. The provider stopped attackers’ access within an hour and is continuing its investigation.
Key points
- Cornerstone says the ransomware attack began on May 26, 2026, and it suspended attackers’ access within an hour.
- The provider said it did not pay a ransom, stopped the encryption process, and restored its electronic data.
- An initial investigation found that information for 2,830 people may have been compromised, including health and substance-use treatment information and Social Security numbers.
- A later investigation found an appointment-reminder log for another 12,000 people may have been viewed or accessed; the company is investigating whether other sensitive information was involved.
- Cornerstone reported the breach to HHS on July 27, 2026, and posted a notice.
Article Details
- Victim Organization
- Cornerstone Behavioral Healthcare
- Victim Domain
- cornerstonebhc.com
- Incident Type
- Ransomware attack
- Incident Date
- 2026-05-26
- Disclosure Date
- 2026-07-27
- Data Types Exposed
- Names
- Addresses
- Other contact information
- Dates of birth
- Health care information
- Substance use disorder treatment information
- Insurance information
- MaineCare information
- Social Security numbers
- Appointment times
- Appointment reminders
- Documentation due reminders
- Affected Records
- Approximately 14,830 individuals: information for 2,830 individuals may have been compromised, and an appointment-reminder log for an additional 12,000 individuals may have been viewed or accessed.
- Operational Impact
- Attackers' access was suspended within one hour of detection. Cornerstone stopped the encryption process and restored its electronic data; it believes less than 10% of data on affected computers and servers may have been encrypted.
- Ransom Or Extortion
- Cornerstone did not pay the ransom. The article does not report an extortion demand or data publication.
- Claim Status
- confirmed