Spindletop Center (TX) Mental Health & IDD Services Breach (2025): 89K Patient Records Including SSN, Driver's License & Diagnoses Exposed via Rhysida

About Spindletop Center

Spindletop Center is a community mental-health and intellectual/developmental-disability (IDD) services provider based in Beaumont, Texas, serving as the local mental-health authority for Jefferson, Hardin, and Orange counties. It provides mental-health treatment, IDD services, substance-use programs, and crisis/community support, maintaining highly sensitive clinical, case-management, and identity records.

Why They Hold Your Data

Behavioral health and support-service providers collect highly sensitive patient identity, treatment, counseling, insurance, and social-service records tied to mental health and community care.

Recent Developments

Spindletop Center was hit by a cyberattack around September 23-29, 2025 that rendered systems temporarily inoperable. The Rhysida ransomware group claimed responsibility on October 30, 2025, demanding roughly 15 bitcoin (~$1.65M) and threatening to publish. Spindletop reported 88,863 individuals affected to HHS, and its investigation concluded on December 3, 2025; class-action investigations followed.

Data Points Exposed

Breach Impact

Because appearing in Spindletop's records signals a mental-health, developmental-disability, or substance-use service relationship, exposure carries acute stigma, discrimination, and coercion risk on top of identity-theft harm from Social Security numbers and driver's licenses. Diagnosis information and case numbers deepen the privacy harm for a vulnerable population, and disclosure of disability status itself creates discrimination risk.

Exploitation & Downstream Threats

• Stigma-based targeting and coercion tied to mental-health, developmental-disability, or substance-use service status | • Identity theft and synthetic identity construction using SSN and driver's license | • Medical identity fraud and insurance abuse using diagnosis data | • Discrimination risk from disclosure of disability/behavioral-health status | • Targeted phishing and vishing; doxxing from exposed home addresses

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
4. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
5. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).