Greater Mental Health of New York Behavioral Health Provider Breach (2025): 61K Patient & Employee Records Including SSN Exposed via Sinobi Ransomware

About Greater Mental Health of New York

Greater Mental Health of New York is a nonprofit community behavioral-health and social-services provider serving the Hudson Valley region, formed through the merger of the Mental Health Association of Westchester and the Mental Health Association of Rockland. It delivers mental-health treatment, counseling, care coordination, and community support services, maintaining client identity, contact, benefits, and case-management records.

Why They Hold Your Data

Community mental-health organizations collect highly sensitive client identity, contact, treatment, counseling, benefits, and case-management records across behavioral-health services.

Recent Developments

Following the October 2025 Sinobi ransomware attack, which exposed employee and client data, the organization faced data-breach class-action investigations. Sinobi, a ransomware-as-a-service group that emerged in mid-2025 (linked to the Lynx/INC lineage), listed the organization on its dark-web leak site.

Data Points Exposed

Breach Impact

Because the records tie individuals to a community mental-health provider, exposure of names, addresses, and Social Security numbers carries stigma and discrimination risk on top of identity-theft harm, affecting both clients and employees. The dark-web listing also referenced financial documents, and any exposure of mental-health treatment status would substantially deepen the harm. The breach undermines trust in a sensitive care setting.

Exploitation & Downstream Threats

• Stigma-based targeting and extortion tied to mental-health provider association | • Identity theft and synthetic identity construction using SSN | • Targeted phishing using exposed email addresses | • Doxxing and physical targeting from exposed home addresses | • Employee-directed social engineering and payroll/HR fraud

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).