Mount Rogers Community Services Breach: Ransomware Exposes Data of 38,000 Patients and Staff

WYTHEVILLE, VA - Mount Rogers Community Services (MRCS), a behavioral-health provider serving Southwest Virginia, has confirmed it was the victim of a ransomware attack in spring 2025. The incident exposed sensitive information belonging to 38,191 patients, employees, and dependents, according to regulator filings and independent reporting.

What Happened?

MRCS says it detected unusual activity on April 29, 2025 and quickly determined it was the result of a ransomware intrusion that began around April 27. The organization immediately isolated affected systems, engaged external cybersecurity experts, and notified law enforcement.

While MRCS has not named the attackers, independent threat-tracking firms confirm that the INC Ransom group later listed MRCS on its dark-web leak site and posted sample data to pressure the provider into paying.

Who Is Impacted?

The breach affected a broad set of individuals connected to MRCS:

• Patients receiving behavioral-health services
• Employees and in some cases their dependents

The types of data vary, but include:

• Names, addresses, and dates of birth
• Social Security numbers
• Health insurance and claims information
• Medical details such as diagnoses, medications, and treatment dates (for some individuals)

MRCS noted that much of the compromised data involved billing and insurance claims, though the extent differs from person to person.

Timeline

• Apr 27, 2025 - Unauthorized access begins (per forensic analysis)
• Apr 29, 2025 - MRCS detects ransomware and contains incident
• June 2025 - INC Ransom posts MRCS on leak site with data samples
• June 13, 2025 - Federal healthcare breach tracker lists 38,191 impacted
• Summer 2025 - Notification letters mailed; state AGs post sample notices

Legal Fallout

Several plaintiff firms have launched class-action investigations into the MRCS breach. At least one firm has claimed to file a complaint, though no public docket has yet been located. Consumers are being urged to retain breach letters, receipts for any credit-monitoring costs, and time spent dealing with fallout, as these may become relevant in litigation.

MRCS Response

The provider says it:

• Contained the attack and engaged forensics
• Notified law enforcement and regulators
• Began notifying impacted individuals in summer 2025
• Offered affected consumers credit monitoring and identity protection services

What You Can Do

If you are a patient, employee, or dependent of MRCS:

1. Review your breach notification letter carefully for enrollment codes.
2. Activate the offered credit monitoring/identity protection immediately.
3. Place a free fraud alert or credit freeze with the major credit bureaus.
4. Monitor health insurance Explanation of Benefits (EOBs) and billing statements for services you don’t recognize.
5. Be alert to phishing attempts referencing medical care, insurance, or behavioral-health services.