Incident · State breach notice (Massachusetts)
JBS Mental Health Authority data breach: a ransomware attack, and records back to 2011
Compiled from public records. Updated 2026-11-14. By the cisonews.net Desk.
The Jefferson-Blount-St. Clair Mental Health Authority data breach affected 30,434 people, according to the federal health breach portal, where Jefferson-Blount-St. Clair Mental Health Authority reported a hacking or IT incident as a health care provider on January 23, 2026. Jefferson-Blount-St. Clair Mental Health Authority (JBS), an Alabama mental health provider, says it learned on November 25, 2025 that it had been hit by a ransomware attack. Files that may have been accessed or taken could relate to patients or employees from any year between 2011 and 2025. The federal health breach list counts 30,434 people. Letters dated March 9, 2026 offer 24 months of Cyberscout credit monitoring.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.
What happened at JBS?
JBS says the unauthorized access happened on November 25, 2025, the same day it learned of the ransomware attack. It secured its network and investigated the nature and scope of the activity. The letter does not say whether systems were encrypted, whether a ransom was demanded or paid, or who was behind the attack. The ransomware glossary entry explains the term.
| Date | What the letter and the regulators' records say |
|---|---|
| November 25, 2025 | Ransomware attack; unauthorized access to the network |
| January 23, 2026 | Report to HHS (30,434) |
| March 9, 2026 | Letter date; logged in Massachusetts (4 residents) |
The report to HHS came 59 days after the attack. Letters followed about six weeks later.
Who is affected?
Anyone who was a JBS patient or employee at any point from 2011 to 2025 may be in the files. The fourteen-year span means former patients and staff who left long ago can receive a letter. The information may include name, Social Security number, health insurance information, date of birth, and medical information such as billing or claims records, diagnosis, physician, medical record number, Medicare or Medicaid information, prescriptions and treatment. For the 4 Massachusetts residents in Jefferson-Blount-St. Clair Mental Health Authority's notice, the state's record marks Social Security numbers and medical records as breached.
What is JBS offering?
| Item | Detail from the letter |
|---|---|
| Service | Single-bureau credit monitoring, credit report and credit score, with alerts for 24 months from enrollment |
| Provider | Cyberscout, a TransUnion company |
| Enrollment | bfs.cyberscout.com/activate, with the code printed on the letter |
| Questions | 866-907-2440, or www.jbsmentalhealth.com; Monday to Friday, 8 a.m. to 8 p.m. Eastern Time |
The guide to credit monitoring offers sets Jefferson-Blount-St. Clair Mental Health Authority's offer beside other letters.
What the documents leave open
- Whether systems were encrypted and whether a ransom was demanded.
- How many of the 30,434 are patients and how many are employees.
- Whether any data has been published.
With 30,434 people, Jefferson-Blount-St. Clair Mental Health Authority's report is the 98th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.
How this disclosure's timing compares
Jefferson-Blount-St. Clair Mental Health Authority disclosed 104 days after the discovery date its notice gives. Across the 206 other state breach notices on cisonews.net that date discovery to the day, the median gap is 100 days.
Other health care incidents on cisonews.net
- MPOWERHealth Holdings LLC, Breach notice, first disclosed November 13, 2026
- Acadia Healthcare Company, Inc., Breach notice, first disclosed November 13, 2026
- Telecare Health, Breach notice, first disclosed November 9, 2026
- Sharecare Health Data Services, LLC, Breach notice, first disclosed November 6, 2026
- Nephrology Associates, P.C., Breach notice, first disclosed November 6, 2026
Sources
- 2026-03-09 · AJefferson-Blount-St. Clair Mental Health Authority, notice of data breach filed with the Massachusetts Office of Consumer Affairs and Business Regulation, published March 9, 2026
- 2026-11-07 · AU.S. Department of Health and Human Services, Office for Civil Rights, breach portal (breaches affecting 500 or more individuals), published November 7, 2026
- 2026-11-07 · AMassachusetts Office of Consumer Affairs and Business Regulation, 2026 Data Breach Notification Report, published November 7, 2026
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
Entries like this one, in Wednesday’s docket
Wednesdays
Unsubscribe any time.