Centerstone, a nonprofit health organization that provides mental health, addiction recovery, residential care, therapeutic foster care, counseling, and crisis services across the country, has learned of a data security incident that may have involved personal and protected health information belonging to certain current and former Centerstone clients. Centerstone has sent notification of this incident to potentially impacted individuals and is providing resources to assist them.
On February 14, 2022, Centerstone detected unusual activity involving its email environment. Upon discovering this activity, Centerstone took immediate steps to secure its email environment and launched a thorough investigation to determine the scope of the issue. The investigation determined that an unknown actor gained access to and may have obtained a limited amount of data from three employee email accounts between November 4, 2021 and February 14, 2022.
As a result, Centerstone undertook a comprehensive review of the full contents of the email accounts to identify whether any individual information was contained therein. Centerstone’s review concluded on July 12, 2022, at which time Centerstone learned that the email accounts contained certain personal and protected health information. In response, Centerstone immediately initiated a diligent search to identify current contact information needed to notify potentially impacted individuals.
Centerstone currently has no evidence of the misuse of any information potentially involved in this incident. However, beginning on August 2, 2022, Centerstone notified potentially affected individuals directly via letter. In so doing, Centerstone provided information about the incident and about steps that potentially impacted individuals can take to protect their information.
The privacy and protection of personal and protected health information is a top priority for Centerstone, which deeply regrets any inconvenience or concern this incident may cause.