Hackers Stole SSN and Patient Health Data from the Addiction Treatment Center Maryhaven

• Maryhaven, a central Ohio addiction treatment center, confirmed that sentitive data was hacked
• Threat actors gained access to the non-profit’s computer network on May 30, 2024
• Patients' diagnosis reports and medical information, along with names and addresses, were exposed to adversaries

The investigations into the unauthorized access discovered by Maryhaven Inc. on June 1, 2024, have confirmed that a third party accessed sensitive information within its computer network. 

Independent forensic specialists ascertained that an unknown entity accessed Maryhaven’s systems on May 30, 2024. After discovering the same the next month, the non-profit initiated an investigation.

Researchers concluded their tests in February this year and shared that the personal and health information of individuals associated with Maryhaven, the central Ohio addiction treatment center, has been breached.

A Claim Depot report detailed that personally identifiable information (PII) and protected health information (PHI) were hacked. The accessed files included full name, address, phone number, email, date of birth, and contact information.

It is speculated that the hackers also stole driver’s license numbers, medical treatment details, Social Security numbers, and health insurance information. The number of individuals whose data was pilfered is not known yet. 

They have been sending notifications to all potentially impacted individuals. Maryhaven reported the security incident to the Department of Health and Human Services Office of Civil Rights, besides law enforcement.

Maryhaven provides cognitive behavioral therapies and counseling services, among other services, to individuals.This data hack puts the sensitive information of patients and their reputation at risk if it gets publicly released on the dark web. 

Moreover, the stolen information, which includes Social Security numbers, contact details, names, and addresses, could be used for spearphishing attacks, creating duplicate documents for making false claims, identity theft, and more.