JBS Mental Health Data Breach
The 2025 JBS Mental Health data breach affected 30,434 people according to the U.S. Department of Health and Human Services record.
Exposed Data Types
6 sensitive9- Health insurance information
- Diagnoses
- Provider names
- Medical record numbers
- Prescription information
- Treatment information
- Names
- Social security numbers
- Dates of birth
About This Breach
Jefferson Blount St. Clair Mental Health Authority's official notice confirms a ransomware attack involving unauthorized access to its network on November 25, 2025.
JBS provides community mental health services in Alabama. The files involved in the incident may relate to certain patients and employees associated with JBS between 2011 and 2025.
How Did the Incident Occur?
JBS learned of the ransomware attack on or around November 25, 2025. Its investigation determined that unauthorized network access occurred that day and that certain files may have been accessed or acquired without authorization. The organization says it assessed the security of relevant systems and continued strengthening its safeguards after discovering the incident.
What Information Was Affected?
The information involved varies by person. The files may contain names, Social security numbers, dates of birth, and health insurance information, along with billing or claims information, diagnoses, physician information, medical record numbers, Medicare or Medicaid information, prescription or medication information, and diagnostic and treatment details.
Who May Have Been Affected?
The official notice says records relating to certain JBS patients and employees may have been involved. It does not state that every person had the same data fields exposed, so notice recipients should rely on the information categories identified in their individual letters.
What Should Affected People Do?
Notice recipients should review credit reports, financial accounts, health-insurance statements, and patient records for unfamiliar activity. If an unknown account, medical service, prescription, or insurance claim appears, contact the relevant organization through a verified channel. People whose Social security numbers were involved may also consider a fraud alert or credit freeze when appropriate.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
