Park Place Behavioral Healthcare data breach: files copied, and what Osceola Mental Health changed

What happened at Park Place Behavioral Healthcare?

Osceola says it secured its systems and hired a specialized third-party cybersecurity firm, whose forensic investigation finished on August 19, 2026. It then reviewed the affected files and settled the list of people to notify on September 17.

Date	What the letter and the regulators' records say
July 5, 2026	Date of breach on Indiana's record
July 23, 2026	Osceola becomes aware of unusual activity
August 19, 2026	Forensic investigation ends
August 26, 2026	Report to HHS (71,702)
September 17, 2026	List of people to notify finalized
September 23, 2026	Letter date; Indiana notice (10 residents)
September 24, 2026	Logged in Massachusetts (52 residents)

Indiana's record puts the breach on July 5, 18 days before Osceola says it noticed anything. The letter itself gives no start date.

What did Osceola change after the breach?

Osceola says it reset all user account credentials, installed endpoint detection and response software to watch its network, tightened its remote access methods and restored operations in a safe mode. The letter does not say how the intruder got in.

What information was involved?

The data varied by person. It may include Social Security number, driver's license or other government ID number, financial account information, health information and health insurance information. For the 52 Massachusetts residents in Park Place Behavioral Healthcare's notice, the state's record marks Social Security numbers, medical records, financial accounts and driver's licenses as breached. Osceola says it has had no reports of misuse or identity theft.

What is Osceola offering?

Item	Detail from the letter
Service	Credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and managed identity theft recovery; the sample leaves the term as 12 or 24 months
Provider	IDX
Enrollment deadline	December 23, 2026
Questions	The number printed on each letter, 9:00 a.m. to 9:00 p.m. Eastern Time, Monday to Friday, excluding U.S. national holidays

The guide to credit monitoring offers sets Park Place Behavioral Healthcare's offer beside other letters, and the guide to healthcare provider breach notices compares other providers' letters.

What the documents leave open

• What happened on July 5, the date on Indiana's record.
• How the unauthorized party got in.
• Whether patients get 12 or 24 months of protection.

With 71,702 people, Park Place Behavioral Healthcare's report is the 62nd largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.