Mental Health Association Data Breach Investigation

Recently, MHA announced that the sensitive personal identifiable information and protected health information in its care may have been compromised. According to the breach notice, on December 2, 2024, MHA discovered that its systems were potentially compromised by an unauthorized actor.¹ As a result, MHA launched an investigation to determine the nature of the incident.

Through its investigation, MHA confirmed that sensitive personal information may have been accessed by an unauthorized third party during the breach. As a result, MHA began a review of the data to determine what information had been impacted, as well as identify the specific individuals affected. On May 20, 2025, MHA completed this review. While the information impacted varies depending on the individual, the type of information potentially exposed includes:

• Name
• Social Security number
• Address
• Date of birth
• Driver’s license number
• Financial account information
• Medical information (e.g., medial diagnosis/condition, medication, medical record number, other medical information)

As a result of the data breach, MHA posted a notice of the incident on its website. Additionally, on May 30, 2025, MHA began sending breach notification letters to impacted individuals. Based on the website breach notice, MHA is providing affected individuals with a list of the specific types of sensitive information impacted. A link to the form breach notification that MHA posted to its website is below.