Denton County MHMR Center 2024 Data Breach

The primary evidence is the data-security notice on the Center's own domain, updated December 30, 2025, together with its linked initial notice PDF. It says information on the network was accessed by an unauthorized party between December 24 and December 25, 2024. This finding establishes that protected data entered the access scope; it is not merely evidence of an outage or unexplained activity.

The HHS OCR row classifies Denton MHMR Center as a Healthcare Provider, the event as a Hacking/IT Incident, and the information location as Network Server; it reports 108,967 affected people. The HIPAA Journal independently compared the official notice, federal record, and updated field list. The three sources align on the organization, access window, and scope.

The Center identified unusual network activity on or around December 24, 2024, secured the environment, and opened an investigation with third-party specialists. The review determined that the unauthorized party had access for a limited period from December 24 through December 25. The incident date is based on the earliest technical activity that can be verified from public sources.

When the organization published an initial substitute notice on February 21, 2025, its file and population review was still underway. It determined the detailed scope of potential data elements on October 10, reported the event to HHS OCR on November 5, and later notified state attorneys general. The web notice was updated December 30 to reflect credit-monitoring and identity-protection services.

The current official list includes names, addresses, patient identification numbers, dates of birth, diagnoses, medical histories, medical record numbers, medical treatment, laboratory information, treating doctors' names, medications, vaccinations, medical insurance information, and biometric identifiers. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

The February PDF, published before the review was complete, also identified Social Security and bank-account numbers as possible fields. The updated December page supplies the detailed results of the completed analysis and does not repeat those two elements.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. The HIPAA Journal identifies the population as current and former patients. The figure counts individuals in the notification scope, not copied files, rows, or fields; one person may have multiple types of information involved.

The official text confirms access to certain information but does not say that files were removed, publicly released, or sold. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope. It likewise does not attribute every listed data category to all 108,967 people.

The Center secured its network after finding the unusual activity and engaged specialists to investigate. It later worked with third-party cybersecurity experts to implement additional network protections and reviewed and enhanced its data-protection policies and procedures. The initial notice also says law enforcement was notified.

The updated notice states that potentially affected individuals were offered complimentary credit monitoring and identity-protection services. At notification, the Center said it had no evidence of information misuse connected to the incident. The absence of observed misuse does not eliminate the longer-term risk presented by sensitive health and biometric information.

Notice recipients can use the Center's dedicated assistance line to confirm eligibility and enrollment deadlines for the offered credit-monitoring and identity-protection services. Credit reports, financial statements, and health-insurance explanations of benefits should be reviewed regularly for unfamiliar accounts, transactions, doctors, laboratory services, or insurance claims.

If an unknown care, prescription, vaccination, or insurance entry appears, contact the provider and insurer through known official channels. Because biometric data cannot be changed like a password, unexpected identity-verification requests deserve particular caution.