Roughly 1,500 patients of Cognitive Behavior Therapy Center in Chesapeake have had their names, Social Security numbers, addresses, phone numbers, diagnoses and treatment records exposed after a ransomware attack hit the practice's third-party billing company. Some of those patients were then directly contacted in an attempted extortion scheme, according to the practice.
The attack targeted Express Billing Systems, the outside company that handles billing for the therapy practice, and occurred in late August 2026, as reported by WAVY.com. An unknown entity gained access to Express Billing Systems' internal systems and demanded a ransom, which was not paid, the outlet reported. That same unknown entity then attempted to extort money from some of the affected patients by contacting them directly.
What Information Was Exposed
The compromised data included names, addresses, phone numbers and Social Security numbers, along with details about services rendered and diagnoses, per the station's report. Cognitive Behavior Therapy Center has said the breach occurred following the ransomware attack on its billing vendor, with the practice's spokesperson confirming the Chesapeake, Virginia, location was affected. Express Billing Systems has since disabled access to its systems and rebuilt them after discovering the intrusion, the same account notes.
Affected patients have been advised to review their credit reports, place fraud alerts and consider a security freeze on their credit files, according to the outlet's reporting. The practice has provided a patient support line at 757-410-0700, while Express Billing Systems has made 757-410-8954 available for billing-related questions.
A Pattern Across Behavioral Health
The Chesapeake incident fits into a wider pattern of trouble for behavioral-health providers and their vendors. Becker's Behavioral Health has tracked a mix of external attacks on networks and email systems alongside unauthorized internal access to patient records across multiple organizations this year. Cornerstone Behavioral Healthcare in Maine, for instance, determined that a ransomware attack in May compromised protected health or personal information for 2,830 individuals, and later found that an appointment-reminder log for another 12,000 people may have also been accessed.
Other recent cases show how varied the exposure routes can be. Southwest Behavioral and Health Services in Arizona reported in May that six employee email accounts had been compromised, affecting 2,316 individuals, while North Texas Behavioral Health Authority disclosed this month that an unauthorized third party accessed its network over a three-day span in October, impacting 285,086 people. A 2025 breach at a separate medical billing company, Medical Computer Business Services, exposed files on more than 1.26 million patients, according to HealthExec.
By the Numbers: A National Surge
Federal statistics help explain why billing vendors like Express Billing Systems have become such frequent targets. HIPAA Journal reports that 772 healthcare data breaches affecting 500 or more individuals were reported to the HHS Office for Civil Rights in 2026, and that ransomware attacks climbed 278% in the years tracked by federal regulators. In July 2026 alone, 77 healthcare breaches of that size were reported, with 67 of them, or 87%, tied to hacking or other IT-related incidents, the outlet's July breach report found. The average breach that month affected 499,200 individuals, though the median was far smaller at 4,851.
Legal Obligations Under Virginia and Federal Law
Under federal guidance from the U.S. Department of Health and Human Services' Office for Civil Rights, breach-notification rules apply to what regulators term unsecured protected health information, meaning data not secured through a method specified by the agency. Virginia law separately requires any individual or entity with a reasonable belief that a resident's personal identifying information was accessed or acquired without authorization to notify the state attorney general and each affected Virginia resident, according to guidance from the Virginia Office of the Attorney General. State notifications must describe the incident in general terms, identify the type of information involved, explain protective measures taken, and advise recipients to monitor their credit reports.
Virginia law also addresses breaches specifically involving medical information. If unencrypted or unredacted medical data was, or is reasonably believed to have been, accessed by an unauthorized person, the responsible entity must disclose the breach without unreasonable delay to both state authorities and affected residents, per the relevant state statute.
