A Mindbloom data breach has surfaced in a filing with Vermont's attorney general, dated November 3, 2026. The filing lists one Vermont resident affected in a breach classed as health care. The company has not said how many patients were involved nationwide, and the cause remains undisclosed.

What Mindbloom disclosed to Vermont

Vermont publishes a public list of security breach notices, and an entry for Mindbloom Provider Group, PA carries a November 3, 2026 date. The entry classifies the incident as health care, lists "Health Records" as the data category and shows one Vermont resident affected. Vermont law requires companies to report breaches that involve residents' private data to the attorney general's office, which is why the filing appears on a public list at all (Vermont Office of the Attorney General).

Two other sources repeat the November 3 date. Claim Depot, a claims-solicitation site, says the breach was disclosed to Vermont's attorney general that day (Claim Depot). Yahoo News, in a report updated November 5, says the exposed data may include clinical notes, diagnoses and prescription details (Yahoo News). The state listing does not include those clinical details, so treat them as reported claims rather than confirmed facts.

Mindbloom has not publicly said when the unauthorized access happened, how it was discovered or when its leadership learned of it. Those are the first questions affected patients will ask, and none of the sources I reviewed answers them.

Who Mindbloom serves

Mindbloom was founded in 2018 and offers at-home ketamine-assisted therapy. The company connects patients with clinicians and medical groups, which means a patient's records may pass between several parties rather than sitting with a single clinic (Claim Depot investigation). That arrangement is useful context when a patient asks where their information may have been held.

How many people are affected

The official record shows one Vermont resident. That number describes Vermont's list, not the company's national footprint. The list only covers breaches reported to that state's attorney general, so a single Vermont line does not establish how many patients were involved in total or how many live outside Vermont. The same Claim Depot investigation page lists the total nationwide count as not disclosed.

Coverage has been far larger in tone. Yahoo's headline calls it a massive data breach, and other coverage uses the same word. The filing I could verify does not support a scale that large. Until Mindbloom or another state regulator says more, the verified count is one Vermont resident and the national total is unknown.

What data may be exposed

The state listing confirms only the category, Health Records. Class Action U notes that the specific data elements have not been publicly disclosed for each person. That leaves a wide range of possibilities. Clinical notes, diagnoses and prescription details are the items Yahoo reports, and they are among the most sensitive parts of a therapy record.

Several claim-solicitation pages also list Social Security numbers and government IDs as affected. Those pages look like generic templates, and their accuracy for this incident is unverified. Until Mindbloom publishes a notice that names the data elements, I would not assume SSNs were taken, and I would not rule them out either.

Lawsuits and the class-action angle

Shamis & Gentile, a class-action firm, says it is investigating the breach. Strauss Borrelli, a plaintiffs' firm, published its own investigation notice on November 4. It described the general misuse risks of health data, including fraudulent billing, false insurance-verification requests, prescription-related inquiries and medical identity theft (Strauss Borrelli). The firm framed that as general risk language, not a finding about this breach.

No lawsuit had been filed in the material reviewed for this story. An investigation notice is not a court filing, and patients who receive solicitations should check the details before sharing personal information.

What affected Mindbloom patients should do now

Start with the company. The affected-person guidance cited in Yahoo's report recommends contacting Mindbloom directly. Then work through these steps:

  • Check your mail and email for a breach notice from Mindbloom. If you were a customer, your state attorney general's breach list is also worth checking.
  • Treat unexpected refund, billing or account messages that mention therapy services as suspicious. Go to the provider's site by typing its address rather than clicking a link.
  • Be wary of calls about insurance claims or prescriptions you did not start. Hang up and call the number on your insurance card or pharmacy label.
  • Consider a credit freeze if a notice says Social Security numbers or government IDs were involved. Credit freezes are free under federal law. The filing I found does not say whether those identifiers were exposed.

For a sense of how far exposed Social Security numbers can travel, read our coverage of the Frontline Education breach.

Why health records breaches are harder to fix

A stolen card number can be replaced within days. A diagnosis, a treatment history or a prescription record cannot be reissued, and it can stay sensitive for years. That is my analysis rather than a sourced finding, but it explains why a breach that appears on paper as one Vermont resident can still matter a great deal to the people involved.

Scale also changes the picture. USA 24 has reported that the Oracle Health Cerner breach is now counted at nearly 20 million, which shows how quickly health-data incidents grow when the operator is large. Nothing public yet suggests the Mindbloom incident approaches that size, but nothing public rules it out either.

What to watch next

Three signals will tell you more than the current coverage. First, additional state filings would show whether the footprint extends beyond Vermont. Second, a statement from Mindbloom would need to explain the timeline, how the intrusion was found and whether attackers stole data or locked systems. Third, any complaint filed by the firms now investigating would bring court records and a formal response from the company.

Mindbloom has not published a public statement that I could find. Until one appears, the verified facts are a November 3 filing, one Vermont resident and a health-records category. Read the next notice closely, and check which data elements it names before deciding how much to worry.