Major Data Breach Announced by Richmond Behavioral Health Authority
Richmond Behavioral Health Authority (RBHA), the public entity responsible for providing mental health, substance abuse, and prevention services in the city of Richmond, Virginia, has recently disclosed a data incident that has affected up to 113,232 individuals.
On or around September 30, 2025, RBHA discovered unauthorized access to its computer systems. An investigation was launched to determine the nature and scope of the unauthorized activity, and third-party cybersecurity experts were engaged to assist with the investigation and ensure that the network, computer systems, and data were secured.
The forensic investigation determined that hackers first accessed its network on September 29, 2025, then deployed ransomware, resulting in file encryption. RBHA said it found no definitive evidence to suggest that there was unauthorized access to patient data; however, since sensitive data may have been accessed, notice is being provided to all individuals potentially affected “out of an abundance of caution.”
The review of the exposed files confirmed that they contained personal and protected health information such as full names, passport numbers, Social Security numbers, financial account information, and health information. RBHA said the investigation into the incident is ongoing; however, additional safeguards have already been implemented to strengthen security and prevent similar incidents in the future. Those measures include retaining a leading service provider to monitor the cybersecurity of its systems, reviewing the security architecture of its systems, and implementing stronger data security policies.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The name of the group behind the attack was not disclosed by RBHA; however, the Qilin ransomware group claimed responsibility for the attack and added RBHA to its dark web data leak site. Qilin claims to have exfiltrated 192 GB of data in the attack and has published the stolen data.
Screenshots on the group‘s data leak site include some patient data, and the directory tree indicates patient data has been leaked. Individuals affected by the breach are therefore advised to remain vigilant against identity theft and fraud.
