Woodfords Family Services, a mental health and social services provider, notified patients and families in March 2026 about a ransomware attack that occurred in 2024. The Portland, Maine based organization disclosed the incident after completing forensic investigation and determining the scope of compromised information.
The attack compromised patient records including names, dates of birth, Social Security numbers, health insurance information, medical record numbers, and treatment details. The delayed notification reflects the extended timeline required for forensic analysis of affected systems and identification of impacted individuals.
Attack Timeline
Woodfords detected unauthorized network activity in 2024 and immediately engaged cybersecurity experts to contain the incident and assess the damage. The investigation revealed that attackers accessed systems containing protected health information before encryption deployment, though no ransomware group has publicly claimed responsibility for the attack.
Patient Notification
The organization is mailing notification letters to all affected individuals and offering complimentary credit monitoring and identity theft protection services. Woodfords emphasized that it has implemented additional security measures including enhanced monitoring systems, employee security training, and network segmentation to prevent future incidents.
Mental health records create heightened risk for affected individuals given the sensitive nature of treatment information and potential for targeted extortion or blackmail attempts. The organization stated no evidence suggests the stolen data has been misused or publicly disclosed.
