DBH Louisville LLC disclosed a data security incident to the Indiana Attorney General on January 27, 2026, triggering legally mandated notification letters. If you are one of the people who received DBH Louisville LLC's letter, your data may have been exposed and you could be entitled to compensation.
The Indiana Attorney General filing confirms the breach notice — not a court case. This tracker shows settlement figures and deadlines solely where a public court record exists. Outcomes are never estimated or promised.
Per the Indiana Attorney General filing, the DBH Louisville LLC incident compromised these categories of personal information:
The more sensitive the data involved, the stronger the potential claim. Disclosure of these categories is legally recognized harm.
DBH Louisville LLC operates within the behavioral healthcare and addiction treatment sector, providing critical clinical services, psychiatric care, and comprehensive counseling programs. Because the organization manages ongoing patient treatment plans, psychological evaluations, and clinical intake records, it routinely collects and maintains a vast repository of deeply sensitive personal and medical data. This information is essential for coordinating patient care, processing medical claims, and maintaining compliance with clinical standards, creating a high-value target for cybercriminals seeking to exploit vulnerable health information systems.
In 2026, DBH Louisville LLC reported a significant data security incident to the Indiana Attorney General. While the full forensic scope remains under investigation, breaches within behavioral health organizations typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized network intrusions, or vulnerabilities within third-party vendor platforms. In many instances, malicious actors exploit outdated security protocols or compromised credentials to infiltrate internal databases, gaining unfettered access to sensitive administrative and electronic health record systems before detection occurs.
Preliminary disclosures and industry standards indicate that the incident likely exposed a wide array of sensitive information, including full names, dates of birth, Social Security numbers, medical record numbers, psychiatric diagnosis details, prescription records, and health insurance information. The exposure of clinical and behavioral health data carries severe, life-altering risks for victims. Unlike basic financial data, medical history cannot be easily changed; unauthorized access to psychiatric and treatment records can lead to targeted medical identity theft, fraudulent insurance claims, severe reputational harm, and distressing phishing scams that weaponize a patient's confidential health history against them.
As a provider handling protected health information, DBH Louisville LLC was bound by stringent legal standards under the Health Insurance Portability and Accountability Act (HIPAA), the Indiana Disclosure of Security Breach Law, and implied duties of reasonable care. These legal frameworks mandate rigorous administrative, physical, and technical safeguards—such as multi-factor authentication, end-to-end encryption, and continuous network monitoring—to protect confidential records from unauthorized intrusion. The occurrence of a data breach strongly suggests a potential failure in these mandated security measures, raising serious questions about whether the organization fulfilled its legal duty to protect consumer privacy.
Receiving an official data breach notification letter from DBH Louisville LLC is a formal acknowledgment that your private information was compromised due to inadequate corporate security practices. Legally, this notification establishes the necessary standing to participate in a class action lawsuit aimed at holding the company accountable for negligence. Affected individuals do not need to prove that they have already suffered actual financial loss or medical fraud to seek legal recourse. Our firm is currently investigating potential claims on a contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.
Notification Delay: Approximately 3 months elapsed between the reported date of the security incident and the company's notification to the Attorney General. Courts have found that excessive notification delays independently support legal claims.
You do not need to show financial loss to be eligible. Courts have treated exposure of personal data as real harm. You likely qualify if any of the statements below describe you:
You received a data breach notification letter from DBH Louisville LLC
You were a customer, patient, employee, or client of DBH Louisville LLC
Your personal information was stored in DBH Louisville LLC's systems
Your Social Security number or driver's license number was exposed
Your medical records, diagnoses, or health insurance information was compromised
You reside in the United States (all 50 states eligible)
That letter is legally required and confirms your data was exposed. It also gives you standing to file a claim.
What your notification letter means & what to do next →Do these four things as soon as possible; each one protects you and strengthens any claim:
Your DBH Louisville LLC notification letter is legal evidence. Keep both physical and digital copies somewhere safe — it establishes you were affected and anchors your claim.
Your letter likely includes a monitoring activation code. Use it: free monitoring flags misuse of your data and records the harm for your case.
Freeze your credit with Equifax, Experian and TransUnion. A freeze blocks new accounts from being opened in your name and can be lifted whenever you need to apply for credit.
Claims windows close. Our team reviews DBH Louisville LLC breach cases free of charge and works on contingency — you pay nothing unless we recover for you.
Security Incident
2025-11-05
Someone gained unauthorized access to data held in DBH Louisville LLC's systems.
Reported to Attorney General
January 27, 2026
The Indiana AG received DBH Louisville LLC's formal data breach disclosure.
Consumer Notification Letters Sent
Within weeks of AG filing
State law obligates companies to mail notification letters to everyone affected.
Legal Window — Act Now
Statute of limitations applies
A statute-of-limitations clock is running on this type of claim.
Breach victims may recover several categories of loss. What applies in the DBH Louisville LLC matter depends on your state, the data involved, and the company's conduct.
Statutory damages exist independent of out-of-pocket loss — California's $100–$750 range is the model other states have followed.
Reimbursement for fraud charges, unauthorized transactions, or expenses you incurred as a direct result of the breach.
The time you lost to credit freezes, fraud disputes, and account monitoring counts as a recoverable inconvenience.
If you paid for credit monitoring or identity protection after the breach, those costs can be recovered.
SSN and driver's license exposure creates long-term identity theft risk. Courts recognize the ongoing value of this harm and may award damages accordingly.
The unauthorized exposure of health and medical information may trigger HIPAA-related claims and additional state health privacy protections.
Indiana's data breach law (IC 24-4.9) requires companies to notify affected residents and the Attorney General. Indiana residents may pursue damages under the Deceptive Consumer Sales Act for a company's failure to protect personal information.
The companies below also filed breach notices with the Indiana Attorney General. Letter recipients for any of them can pursue a review.
Zaxis Financial Services Americas LLC
Indiana · Sep 2026
Woodlawn Hospital
Indiana · Sep 2026
Wooddesign RV Interiors LLC
Indiana · Sep 2026
Woodard, Emhardt, Henry, Reeves, & Wagner LLC
Indiana · Aug 2026
Wired Communications
Indiana · Jun 2026
33156
Indiana · Mar 2026
Contact us for a FREE consultation. No fee unless we win your case.
(786) 306-7278Free Claim ReviewLaw Office of David S. Harris