Devereux data breach: files copied November 6 to 9, 2025, and 86,958 people notified

Who did the Devereux breach affect?

Not only patients. Devereux says it keeps information about current and former employees, clients, donors, payors and business partners, and its notice covers all of those groups. A letter can therefore reach a former employee or a donor as well as a client. Devereux describes itself as a nonprofit behavioral health provider for people with emotional, behavioral and cognitive differences.

What happened, and when?

Devereux says it isolated its systems, brought in third-party specialists and reported the event to law enforcement. It began notifying people and regulators on January 8, 2026, while the investigation was still going on.

Date	What happened	Source
November 6 to 9, 2025	Unauthorized access; files copied	Devereux notice
November 9, 2025	Suspicious activity identified	Devereux notice
January 8, 2026	First notices; report to HHS (501 people)	Devereux notice; HHS portal
July 23, 2026	Indiana notice (86,958 in total); Texas publishes 5,341 Texans	Indiana and Texas records

The federal portal still shows the January figure of 501 people, filed before the review was finished. Indiana's total, filed six months later, is 86,958.

What information was involved in the Devereux breach?

A long list, varying by person: name, date of birth, Social Security number, driver's license or state ID number, US alien registration number, taxpayer identification number, digital or electronic signature, financial account information, payment card information, medical information and health insurance information. Devereux says there is no sign of actual or attempted identity theft or fraud from the incident.

Texas's record lists six of these types for its 5,341 residents: name, Social Security number, driver's license number, government-issued ID number, medical information and health insurance information.

How many people were affected by the Devereux breach?

86,958 people, the total Devereux reported to Indiana.

Record	What it counts	Number
Indiana attorney general	People affected in total	86,958
Texas attorney general	Texans	5,341
HHS Office for Civil Rights	People affected (filed January 8, 2026)	501
Indiana attorney general	Indiana residents	53

The ranking of the largest 2026 breach notices sets this total among the year's other notices, and the guide to healthcare provider breach notices compares what other providers told patients.

What is Devereux offering people who got a letter?

Complimentary credit monitoring through Experian. Devereux also says it reviewed its procedures and policies and is adding employee training. Questions go to 833-745-1528, Monday to Friday, 8:00 a.m. to 8:00 p.m. Central time, or by mail to The Devereux Foundation, Attn: Compliance, 444 Devereux Drive, Villanova, PA 19085. The guide to credit monitoring offers explains what monitoring covers and what a free credit freeze adds.

Was my information in the Devereux data breach?

If you got a letter from The Devereux Foundation in 2026, your information was in the copied files. If you are a current or former employee, client, donor or business partner and did not get one, the number above is the place to ask. Devereux asks people to check account statements and the explanations of benefits from their health insurer, as well as their credit reports.

What the documents leave open

• How the intruder got in, and whether a ransomware group was involved.
• How many of the 86,958 are patients and how many are employees, donors or others.
• Why the federal record still shows 501.