Mindpath Health Settles Claim for $3.5M; Delta Dental Notifies 146,000 of Breach
Email breaches continue to plague the healthcare sector, resulting in data compromises that often affect the sensitive information of scores of patients. Two recent incidents illustrate the risks email breaches pose to patients, and the potential legal fallout for providers.
See Also: Thwarting Cyberthreats in the Power Sector
In separate incidents, California-based Community Psychiatry Management, which does business as Mindpath Health, and dental insurer Delta Dental of Virginia reported breaches that started with email compromises.
Mindpath Health Settlement
Mindpath Health, which provides mental health services in seven states, recently agreed to pay $3.5 million under a preliminary agreement to settle class action litigation filed in the aftermath of two 2022 email breaches affecting nearly 194,000 patients.
The breaches in March 2022 and July 2022 involved hackers accessing two employees’ Microsoft Office 365 business email accounts and exfiltrating personally identifiable information of Mindpath Health patients and other individuals (see: 2 Hacks Involving Mental Health Data Affected Nearly 400,000).
Under the settlement, scheduled to be heard in court on Feb. 19, 2026, each class member will be able to submit a claim for up to $1,500 for documented ordinary out-of-pocket losses, or up to $10,000 for extraordinary documented losses that reasonably stem from the data breach.
Eligible documented ordinary out-of-pocket expenses include unreimbursed losses resulting from identity theft or fraud, bank fees and related expenses.
Documents required for extraordinary losses include unreimbursed losses related to identity theft, fraud, falsified tax returns and other misuses of a class member’s private information that are fairly traceable to the Mindpath Health data security incident.
Alternatively, each settlement class member can instead submit a claim for a pro-rata cash payment estimated to be about $50.
California subclass members also will receive a $50 statutory cash payment.
Class members are also being offered three years of complimentary credit monitoring, regardless of the type of payment claims they file.
Mindpath Health did not immediately respond to Information Security Media Group’s request for comment on the settlement or the data breach incidents at the center of the litigation.
The proposed class action litigation, which among other claims, alleged Mindpath Health was negligent in failing to protect individuals’ sensitive personal information.
Delta Dental of Virginia Breach
In a more recent incident, Delta Dental of Virginia last week began notifying regulators and nearly 146,000 people of an email breach discovered in April.
Similar to the Mindpath Health incident, hackers accessed and acquired Delta Dental of Virginia’ email messages and attachments potentially containing plan members’ and their family members’ information.
The company in a breach notice issued Friday said that on or around April 23, Delta Dental of Virginia discovered suspicious activity associated with one email account and immediately launched an investigation.
Investigators determined that some emails and attachments were potentially accessed and acquired without authorization between March 21 and April 23, 2025, the insurer said.
Potentially compromised information includes individuals’ names, Social Security numbers, state or federal government issued ID numbers and health information. Delta Dental of Virginia said it has no evidence of misuse, or attempted misuse of any potentially affected information.
Delta Dental of Virginia said it has “implemented measures to enhance security and minimize the risk of a similar incident occurring in the future.”
The company did not immediately respond to ISMG’s request for additional details about the breach.
2 Million Email Hacks and Counting
So far this year, healthcare providers and their vendors have reported 152 incidents involving email breaches that have affected nearly 2.2 million people, according to the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website as of Monday. Email incidents account for nearly 27% of all incidents reported so far in 2025 – though the numbers will likely climb as the HHS Office for Civil Rights catches up from a backlog of breaches submitted during the federal government shutdown.
So far in 2025, the HHS HIPAA breach reporting website shows that the largest email breach this year was reported in March by a Tennessee-based United Seating and Mobility, LLC – which operates under the name Numotion. That incident affected nearly 500,000 people (see: Wheelchair Firm Ramps Up Notices to 500,000 for Email Hack).
“For many of these entities, email is the primary way that they interface with the outside, untrusted world, which is ultimately where these types of incidents are most likely to happen,” said Will Gadzinski, senior director of incident response at security consultancy Pondurance.
Despite efforts to better educate workforces about phishing risks, employees still often fall victim to phishing scams, heightening the risks.
“Phishing attacks and other social engineering techniques take advantage of people’s tendency to not think at certain times; sometimes they try to inject a sense of urgency hoping someone will panic, other times they will fly under the radar hoping no one will catch any ‘red flags,” he said.
“In both cases, these are situations where one’s ‘cyber aware’ brain isn’t fully functional. Instead, the victims tend to fall back on their instincts rather than what they’ve been ‘told’ to do.”
Unfortunately, attackers are not only getting more sophisticated through the adoption of AI tools, but they are also getting more and more creative in the ways they are finding to trick people into making mistakes, Gadzinski said.
AI tools will make the barrier to entry significantly lower for anyone seeking to engage in believable, realistic phishing and social engineering campaigns, he said. “It will allow non-native speakers to craft believable and realistic communications in any email, and can often adapt to the writing style of its targets and craft similar messages in an automated fashion, making running a large campaign much more manageable by an individual or small group,” he said. This increase in threat actor scalability will very likely result in a higher risk of email breaches.
Gadzinski advises healthcare organizations to apply best practices including man-in-the-middle resistant multifactor authentication, strict conditional access policies, 24/7 monitoring and strong identity verification for help desk requests.
“Unfortunately, these will continue to only be partially effective, and they need to be backed by a user base who has been educated on contemporary phishing campaigns and how to recognize red flags.”
Security firm Paubox in a report issued earlier this year found that Microsoft 365 accounted for 43.3% of healthcare email breaches in 2024, by far the most common email platform compromised.