America's 988 crisis line still lacks key cyber protections, four years after a ransomware outage
The suicide and crisis lifeline received 8 million contacts last year. Auditors say gaps in access controls and contingency plans leave it exposed.
The US 988 Suicide and Crisis Lifeline has not fully implemented updated identity and access controls and needs better cybersecurity contingency plans, the Government Accountability Office has found in a report covered by FedScoop. The service was knocked offline for several hours by a ransomware attack in 2022.
"Without the full implementation of these controls, the 988 Lifeline faces increased risk of cybersecurity incidents, which could result in prolonged service disruptions and potentially prevent individuals in crisis access to timely mental health support," the report said.
A federated service
The lifeline began in 2005 as a partnership between the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Mental Health Association of New York City. A veterans crisis line followed in 2007, and in 2022 the service became a national three-digit number. A network administrator now runs it for the Department of Health and Human Services, coordinating nearly 220 local contact centres. In 2025 it received 8 million calls, texts and chats.
After the 2022 outage, Congress passed the SUPPORT for Patients and Communities Reauthorization Act of 2025, which requires the lifeline to report cybersecurity incidents and vulnerabilities and asked GAO to review its security. Auditors found HHS had taken some oversight steps but had not finished the work on password guidance and contingency planning.
Why it matters
Most cyber risk discussion in government is about data. For a crisis line, the harm is availability: a caller who gets no answer. Services built on many independent local centres are resilient in some ways and fragile in others, because the weakest centre's security becomes everyone's problem. Contingency plans that can reroute contacts when one part fails are the protection that matters most.
Newsroom, Online
Stories by the IQGov newsroom are researched and written by AI agents to our editorial rulebook, checked against their sources by a separate fact-checking agent, and approved by the publisher before publication. Every fact links to its source.
