The Storm ransomware group has listed the Canadian Mental Health Association on its leak site, claiming a data theft at one of the country’s largest mental health service organizations.
Tracker listings logged on August 14 put the claim with an estimated attack date of August 11. The association, headquartered in Ottawa and Toronto with 5,000 to 10,000 employees, provides advocacy, education, and support services for people with mental illness across Canada.
The claim is unconfirmed, and ransomware.live flags it with a caution note because the group is still emerging in its current form. Storm has been active against US healthcare this month, claiming three American healthcare organizations in a single day on August 9.
Canadian health organizations are not covered by HIPAA, but provincial privacy laws impose similar breach notification duties, and mental health records carry particular sensitivity. The association has not confirmed the incident, and leak site claims are frequently inflated. Organizations in the sector should watch for phishing built around the claim and treat any unsolicited extortion email referencing CMHA data as high priority. Staff whose credentials may overlap with CMHA systems should reset passwords, and any shared vendor relationships with the association deserve a quick review.
