High Point Treatment Center Addiction & Behavioral Health Provider Breach (2025): 184K Patient Records Including Medical Diagnosis & SSN Exposed

About High Point Treatment Center

High Point Treatment Center, Inc. (part of High Point & Affiliated Organizations) is a major Massachusetts nonprofit provider of substance-use disorder and behavioral-health treatment, operating detox, residential, and outpatient programs across locations including Brockton, New Bedford, and Plymouth. It maintains highly sensitive patient identity, clinical, insurance, and billing records, plus employee data.

Why They Hold Your Data

Behavioral health and addiction treatment providers collect highly sensitive patient identity, contact, insurance, billing, and treatment-related records tied to substance use and mental health services.

Recent Developments

The Abyss ransomware group listed High Point on its dark-web leak site on July 26, 2025, claiming roughly 1.8 TB of exfiltrated data. High Point detected unusual activity around July 6, 2025 (intrusion window ~June 17-July 7, 2025) and began mailing notifications on July 29, 2025. Reported counts vary (one AG filing cited ~4,613 individuals for employment-related data), and the total patient count is not clearly confirmed. Class-action investigations followed.

Data Points Exposed

Breach Impact

Because appearing in High Point’s records signals a substance-use or behavioral-health treatment relationship, the exposure carries acute stigma, discrimination, and extortion risk on top of identity-theft harm from Social Security numbers and dates of birth. Substance-use records are federally protected under 42 CFR Part 2. The breach affects a vulnerable population, and the notification itself can be disruptive for people in active recovery.

Exploitation & Downstream Threats

• Stigma-based targeting and coercion tied to substance-use/behavioral-health treatment | • Identity theft and synthetic identity construction using SSN and DOB | • Medical identity fraud and insurance abuse using treatment data | • Targeted phishing and vishing referencing behavioral-health care | • Doxxing and physical targeting from exposed home addresses | • Discrimination risk (protected SUD records under 42 CFR Part 2)

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
4. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
5. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).