Ransomware Attack Targets Maine Mental Health Provider AMHC, Linked to Russia-Based Qilin Group
Aroostook Mental Health Center (AMHC), a major behavioral healthcare provider serving rural Maine, has been hit by a ransomware attack allegedly carried out by the Russia-based cybercrime group Qilin. The organization, which operates 27 service locations across Aroostook, Hancock, and Washington counties and serves over 5,500 clients, was added to Qilin’s dark web data leak site on Tuesday, according to reports from ransomware-tracking groups.
AMHC confirmed the incident in a statement, describing it as a "network disruption" and revealing that it had engaged cybersecurity specialists to investigate. Spokesperson Clare Hickey noted that the public listing of AMHC’s name was a consequence of the organization’s refusal to engage with the attackers. Details about the timing of the attack and whether data was exfiltrated remain unclear, as AMHC declined to provide further information.
Qilin, identified as a leading ransomware threat, operates under a ransomware-as-a-service (RaaS) model, leasing its malicious software to other hackers. Despite its name shared with a Chinese mythological creature analysts, including the U.S. Department of Health and Human Services, link the group to Russia. By late October 2025, Qilin had claimed responsibility for over 700 attacks, including a high-profile June 2024 breach of a UK pathology provider that disrupted 10,000 appointments and was linked to a patient death.
The attack on AMHC underscores the escalating threat of ransomware, with the FBI reporting $16.6 billion in losses from such incidents in 2024 a 33% increase from the previous year. The healthcare sector remains a prime target due to its sensitive data and critical services.
Source: https://www.govtech.com/security/maine-mental-health-agency-targeted-in-russian-cyber-attack
AROOSTOOK MENTAL HEALTH SERVICES, INC cybersecurity rating report: https://www.rankiteo.com/company/amhc
"id": "AMH1774563831",
"linkid": "amhc",
"type": "Ransomware",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '5,500+ clients',
'industry': 'Healthcare / Mental Health',
'location': 'Aroostook, Hancock, and Washington '
'counties, Maine, USA',
'name': 'Aroostook Mental Health Center (AMHC)',
'size': '27 service locations, over 5,500 clients',
'type': 'Healthcare Provider'}],
'data_breach': {'data_encryption': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Sensitive healthcare data '
'(potentially personally '
'identifiable information)'},
'description': 'Aroostook Mental Health Center (AMHC), a major behavioral '
'healthcare provider serving rural Maine, was hit by a '
'ransomware attack allegedly carried out by the Russia-based '
'cybercrime group Qilin. The organization was added to Qilin’s '
'dark web data leak site after refusing to engage with the '
'attackers.',
'impact': {'brand_reputation_impact': True,
'data_compromised': True,
'identity_theft_risk': True,
'operational_impact': 'Network disruption, potential disruption of '
'healthcare services'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain (ransomware-as-a-service)',
'ransomware': {'data_encryption': True,
'ransomware_strain': 'Qilin ransomware'},
'references': [{'source': 'Ransomware-tracking groups'}],
'regulatory_compliance': {'regulations_violated': ['HIPAA (potential)']},
'response': {'communication_strategy': 'Public statement confirming the '
'incident',
'incident_response_plan_activated': True,
'third_party_assistance': 'Cybersecurity specialists'},
'threat_actor': 'Qilin Group',
'title': 'Ransomware Attack on Aroostook Mental Health Center (AMHC)',
'type': 'Ransomware'}