Ransomware Attack on Alabama Mental Health Provider Exposes 30,000 Patients’ Data The Jefferson Blount St. Clair (JBS) Mental Health Authority in Birmingham, Alabama, has disclosed a November 2025 ransomware attack affecting 30,434 individuals. The breach compromised sensitive personal and medical data, including names, Social Security numbers, health insurance details, dates of birth, diagnoses, treatment records, and Medicare/Medicaid information, spanning records from 2011 to 2025. The ransomware group Medusa claimed responsibility on December 23, 2025, demanding a $200,000 ransom to destroy 168.6 GB of stolen data. The group posted sample documents as proof, though their authenticity remains unverified. JBS has not confirmed Medusa’s involvement, nor disclosed whether a ransom was paid or how the breach occurred. The organization’s notice to victims did not include offers of credit monitoring or identity theft protection. Medusa, active since 2019 and operating a ransomware-as-a-service (RaaS) model, has increasingly targeted healthcare providers. In 2025 alone, the group claimed 35 confirmed attacks over half in the healthcare sector exposing 1.76 million individuals’ data. Healthcare victims faced an average ransom demand of $454,000. The JBS incident is part of a broader surge in healthcare ransomware attacks in 2025. Comparitech researchers recorded 113 confirmed attacks on U.S. hospitals and clinics, compromising 8.9 million patients’ records. Other recent breaches include: - Neurological Associates of Washington (13,500 victims, claimed by DragonForce) - MACT Health Board (Rhysida demanded $662,000) - Alpine Ear, Nose & Throat (65,648 victims, claimed by BianLian) Such attacks disrupt critical systems, forcing providers to cancel appointments, divert patients, or revert to manual records, while exposing sensitive data to potential misuse. JBS operates four mental health facilities across Jefferson, Blount, and St. Clair counties in Alabama. The full impact of the breach remains under investigation.