Lifeways Data Breach
The 2026 Lifeways data breach affected 343 people according to the notification made to the Oregon Attorney General. The incident involved unauthorized access to a limited number of emails in certain employee email accounts.
Exposed Data Types
8 sensitive14- Medical record numbers
- Diagnoses
- Treatment information
- Prescription information
- Provider names
- Health insurance information
- Patient IDs
- Medical information
- Names
- Dates of birth
- Social security numbers
- Driver's license numbers
- Government issued IDs
- Financial account information
About This Breach
Lifeways is a nonprofit provider of mental-health, addiction-treatment, and related behavioral-health services in Oregon and Idaho.
How Did the Incident Occur?
Lifeways detected suspicious activity associated with an employee email account on January 20, 2026. It secured its email system and an investigation with outside specialists determined that emails in certain employee accounts had been subject to unauthorized access. The review of the affected emails was completed on May 8, 2026.
What Information Was Affected?
The information varied by person. The disclosed scope includes names, dates of birth, Social Security numbers, driver's license or state identification numbers, financial-account numbers, and medical record numbers. Diagnoses, treatment or procedure details, prescriptions, treatment locations, provider names, clinical information, Medicare and Medicaid numbers, health-insurance information, and patient account numbers may also have been involved.
How Did Lifeways Respond?
The organization said it secured its email system and network, conducted a comprehensive review with outside specialists, and notified people who may have been affected. At the time of the notice, Lifeways said it had no evidence that the information had been misused.
What Should Affected People Do?
Notice recipients should regularly review financial accounts, credit reports, and health-insurance explanations of benefits for transactions or services they do not recognize. They should contact the relevant financial institution, health insurer, or healthcare provider directly if they find suspicious activity and consider a fraud alert or credit freeze when appropriate.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
