Almeida Law Group is investigating a data breach at Cornerstone Behavioral Healthcare. If you were affected, contact Almeida Law Group.
About Cornerstone Behavioral Healthcare
Cornerstone Behavioral Healthcare (CBH) is a behavioral health provider that has operated in Maine since 2008, with outpatient offices in Bangor and Waterville and an affiliate network of subcontracted providers across the state. The organization offers outpatient therapy, medication management, psychological testing, Behavioral Health Home case management, substance use disorder treatment including Office-Based Opioid Treatment and Suboxone services, and peer recovery support. It accepts MaineCare and private insurance. Because CBH treats patients for mental health conditions, dual diagnosis, trauma, and substance use disorders, the personal and health information it maintains is particularly sensitive.
What Happened?
Cornerstone Behavioral Healthcare was listed in an HHS Office for Civil Rights breach portal report dated July 27th, 2026, identifying a hacking/IT incident affecting network servers and a total of 14,830 individuals.
According to Cornerstone’s own public notice published in the Bangor Daily News, the organization discovered a ransomware attack on May 26th, 2026. The attack was initiated and discovered on the same day, and access by the attackers was suspended within approximately one hour. The ransomware was in the process of encrypting Cornerstone’s data when systems were powered down. A ransom demand was made, but Cornerstone did not pay and was able to restore its electronic data from backups. The organization estimates that less than 10% of the data on affected computers and servers may have been encrypted before shutdown.
Cornerstone’s initial investigation determined that the protected health information and personal information of 2,830 individuals may have been compromised. For those individuals, the potentially exposed data includes names, addresses, other contact information, dates of birth, health care information, substance use disorder treatment information, insurance and MaineCare information, and Social Security numbers. On July 22nd, 2026, continued investigation revealed that an appointment reminder log for an additional 12,000 individuals may have been viewed or accessed during the attack. For that group, the potentially exposed data includes patient names, dates of birth, appointment times, and reminders of documentation due. No ransomware group has been publicly attributed to the attack based on available sources.
Key Facts at a Glance
- Company or Organization: Cornerstone Behavioral Healthcare
- Industry: Behavioral health / mental health and substance use disorder treatment (Healthcare Provider)
- Location: Bangor, Maine, with a second office in Waterville, Maine
- Incident type: Hacking/IT Incident (ransomware attack) — Network Server
- Date of breach: May 26th, 2026
- Date breach discovered: May 26th, 2026
- Date of consumer notification: July 27th, 2026 (HHS breach submission date); July 22nd, 2026 (expanded scope identified)
- Total persons affected: 14,830
- Source: HHS Office for Civil Rights breach portal report; Cornerstone Behavioral Healthcare — Public Notice of Breach (Bangor Daily News)
What Should You Do?
If you received a notice from Cornerstone Behavioral Healthcare, take steps now to protect yourself. Enroll in any identity theft protection services Cornerstone is offering and note any enrollment deadline. Consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to prevent new accounts from being opened in your name. Monitor your credit reports for unfamiliar accounts or inquiries; you can request free reports at AnnualCreditReport.com. Because health and substance use disorder treatment information may have been exposed, carefully review your Explanation of Benefits statements and medical records for services you did not receive or authorize. If you discover signs of fraud or identity theft, report them at IdentityTheft.gov, which provides a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
