Mindpath Health, a US-based mental health provider offering in-person and telehealth services, experienced a data breach in March and July 2022 when an unauthorized third party accessed its Microsoft Office 365 business email accounts. The incident exposed personal and protected health information (PHI) of thousands of patients, including sensitive medical and identifying details. Affected individuals filed a class-action lawsuit, alleging negligence in cybersecurity measures that could have prevented the breach. While Mindpath denied wrongdoing, it agreed to a $3.5 million settlement, offering victims cash payments (based on time/lost wages), three years of credit monitoring, and a $50 statutory payout for California residents. The breach led to legal repercussions, reputational damage, and financial compensation obligations, with potential long-term risks like identity theft or fraud for exposed patients. The settlement terms also include claim submission deadlines and a final approval hearing in February 2026.

$3.5 Million Mindpath Health Data Breach Settlement Gets First Nod A California Superior Court judge has given preliminary approval to a settlement to resolve litigation against Community Psychiatry Management, LLC, operating as Mindpath Health, to resolve a class action lawsuit stemming from two email data breaches in 2022 that affected 193,947 individuals. Mindpath Health is a California-based mental health service provider serving patients in seven U.S. states. In March 2022 and again in June 2022, unauthorized individuals gained access to Microsoft Office 365 business accounts that contained the protected health information of Mindpath Health patients and other individuals. The breach was discovered in June during a routine audit of its email environment, which identified suspicious account activity. The investigation confirmed that two email accounts had been subject to unauthorized access in March and June 2022, exposing names, addresses, Social Security numbers, dates of birth, medical diagnoses, prescriptions, treatment information, and health insurance information. Notification letters were sent to the affected individuals on January 10, 2023, almost seven months after the breach was identified A class action lawsuit was filed in the Eastern District of California by plaintiff Corina Lowrey on January 30, 2023, followed by two further complaints from other Mindpath Health patients. The lawsuits were consolidated into a single complaint – Lowrey, et. al., v. Commu

The California Office of the Attorney General reported a data breach affecting Mindpath Health on January 10, 2023. The breach involved unauthorized access to two employee email accounts occurring in March 2022 and June 2022, potentially exposing limited protected health information. The specific number of individuals affected is unknown.