Devereux Foundation, a behavioral healthcare provider, detected suspicious activity on its systems on November 9, 2025. An unauthorized actor had access to its systems between November 6 and November 9, 2025. On June 23, 2026, the foundation concluded that personal data may have been exposed.
The breach potentially involved names, dates of birth, Social Security numbers, driver's license/state ID numbers, taxpayer identification numbers, U.S. alien registration numbers, electronic signatures, financial account information, payment card information, medical information, and health insurance information. While the total number of affected individuals is not publicly known, at least 43 Vermont residents and 577 Rhode Island residents were affected. Devereux Foundation mailed notices to affected individuals on July 23, 2026, and reported the incident to the Vermont Attorney General's Office on the same date.
Additional details about the full scope of the breach and any further regulatory actions may emerge as investigations continue. Notices to other state attorneys general or affected individuals in other states are not yet disclosed.