North Texas Behavioral Health Authority data breach: files taken in October 2025, 284,525 Texans

What happened at NTBHA?

NTBHA says it worked with outside cybersecurity professionals. On January 7, 2026 it determined that the affected files may have held personal information. It began notifying people on March 6, 2026.

Date	What the notice and the regulators' records say
October 13 to 15, 2025	Files may have been accessed and removed
October 15, 2025	NTBHA detects the unauthorized access
January 7, 2026	NTBHA determines the files may have held personal information
March 6, 2026	Notices to individuals begin; report to HHS (285,086)
March 9, 2026	Posted by Texas (284,525)
March 13, 2026	Logged in Massachusetts (10)

Notices began 142 days after detection and 58 days after NTBHA found that personal information was involved. The guide to notice delays compares that gap across the log.

Who does NTBHA serve, and whose records were involved?

NTBHA provides mental health and substance use treatment and services in Dallas, Ellis, Hunt, Kaufman, Navarro and Rockwall counties, The HIPAA Journal reported, and the files that may have been viewed or taken held patient information. The Texas count, 284,525, is almost the whole HHS total of 285,086, so nearly everyone notified lives in Texas. If you received behavioral health or substance use services through NTBHA in those six counties and got a letter from March 2026, it is about this incident.

How big is the NTBHA breach?

At 285,086 people it was the 6th largest breach reported to the HHS Office for Civil Rights in 2026 when The HIPAA Journal wrote about it on April 21. The ranking of 2026 healthcare breaches reported to HHS has its current place. NTBHA's own notice does not list the data types; the Texas record is the fullest list published.

Did a ransomware group claim the NTBHA attack?

Not as of April 21, 2026, when The HIPAA Journal reported that no threat actor appeared to have claimed responsibility. NTBHA's own notice does not describe the attack type; it says an unauthorized party accessed the network from October 13 to October 15, 2025 and that files may have been viewed or taken.

What information was involved?

NTBHA's notice does not list the data. The Texas record lists names, addresses, Social Security numbers, driver's license numbers, medical information, health insurance information and dates of birth. Massachusetts marks Social Security numbers and medical records as breached.

Is NTBHA offering credit monitoring?

Only to people whose Social Security numbers were in the files. Everyone notified gets guidance on protecting their information.

Item	Detail from the notice
Credit monitoring	Offered to people whose Social Security numbers were involved
Response line	1-833-289-1629, 8:00 a.m. to 8:00 p.m. Eastern, Monday to Friday, excluding holidays
Line open for	90 days

The notice also recommends a free one-year fraud alert, and a security freeze at no charge, at the three credit bureaus.

What has NTBHA changed?

It says it reset passwords, expanded multi-factor authentication and deployed endpoint detection and response tools.

What the documents leave open

• How the intruder got in.
• Which kinds of records were in the files: patient records, provider records or both.
• How many of those notified were offered credit monitoring.

The guide to healthcare provider breach notices compares other providers' notices.