CMHA National Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continued through late 2022 to target healthcare and community-support organisations, treating internal files as leverage and publishing victim names on leak sites when negotiations stalled. Against that backdrop, CMHA National appeared on a listing attributed to the AvosLocker ransomware group, a development reported on 26 December 2022. Public detail remains limited: the number of people affected is unknown, and the only description of what left the network is “internal files exfiltrated in a ransomware attack.”

For an organisation whose work centres on mental-health advocacy, education and direct support, any confirmed or claimed exposure of internal material raises immediate questions about the privacy of people who rely on those services. The following account stays strictly within the published facts and well-established public knowledge of the actor and the sector.

Inside the incident

On 26 December 2022 it was reported that CMHA National had been listed by the AvosLocker ransomware group. The listing itself constitutes the group’s claim that it had conducted a ransomware attack and exfiltrated internal files. No further technical particulars—initial access vector, duration of access, encryption of production systems, or ransom demand—have been disclosed in the available record. The scale of the incident is likewise unknown; no figure for affected individuals or volume of data has been published. What is stated is simply that internal files were taken during a ransomware attack and that the organisation’s name subsequently appeared on the group’s leak site.

The group behind it: avoslocker

AvosLocker is a ransomware operation that emerged in the public threat landscape in 2021 and remained active through 2022. Like many contemporaneous groups, it typically combined data theft with encryption, then threatened to publish stolen material on a dedicated leak site if payment was not received. The group was known to target a range of sectors, including healthcare and non-profit organisations, and to advertise victims by name as pressure. Public reporting has documented its use of common initial-access methods and double-extortion tactics; none of those general patterns, however, have been independently confirmed in relation to the CMHA National listing. The appearance of the organisation’s name on the leak site is therefore best understood as an unverified claim by the group rather than a fully corroborated forensic finding.

About CMHA National

The Canadian Mental Health Association (CMHA) National is the national office of a long-established community mental-health organisation. It provides advocacy, public education, research support and coordination for a network of local branches that deliver direct services across Canada. Organisations of this type routinely hold or process sensitive personal information—contact details, case notes, referral records, employee data and internal operational documents—because their mission requires close engagement with people experiencing mental-health challenges and with the professionals who support them. A breach affecting such an entity is consequential precisely because the data it handles can reveal health status, personal circumstances and trust relationships that individuals reasonably expect to remain private.

What was likely exposed

The only data category named in the available facts is “internal files exfiltrated in a ransomware attack.” No inventory of those files, no confirmation of personal identifiers, clinical notes or financial records, and no statement of volume have been released. Organisations comparable to CMHA National typically maintain personnel records, donor or member lists, programme documentation, correspondence and, in some cases, client-related information shared under strict confidentiality rules. Whether any of those categories were among the files taken remains unconfirmed. Readers should treat every specific claim about content as provisional until the organisation or independent investigators publish verified details.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include unwanted contact, social embarrassment, or targeted phishing that references genuine organisational details. Mental-health related data, if present, carries heightened sensitivity because disclosure can affect employment, relationships or personal safety. For the organisation itself, the incident creates operational, reputational and regulatory burdens: the need to investigate, to notify affected parties where required by law, and to restore confidence among clients, staff and partners. Because the number of people affected is unknown and the precise contents unconfirmed, the full scope of harm cannot yet be measured; the prudent assumption is that any internal material leaving the network warrants careful review and protective steps by those who interact with CMHA National.

If your data was in this claimed breach

If you have a past or present connection with CMHA National—as a client, employee, volunteer or partner—monitor account statements and email for unexpected activity, and treat unsolicited messages that reference the organisation with caution. Consider placing fraud alerts with credit bureaus if financial identifiers could have been involved, and change passwords on any accounts that reused credentials associated with the organisation. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official updates, when they become available, should come directly from CMHA National or from Canadian privacy authorities; rely on those channels rather than secondary claims.

AICompiled with AI assistance from public sources and published under our editorial standards.