Pyramid Healthcare has been named in an unconfirmed ransomware claim. This page explains what has been reported so far, what remains unknown and what steps people connected to the provider can take now.
Because no official notice has been published, the details below may change as more information becomes available.
Pyramid Healthcare’s Data Breach Investigation
Pyramid Healthcare, Inc. is a behavioral health and addiction treatment provider based in Pennsylvania. Public profiles describe a range of services, including medical detox, residential treatment, partial hospitalization, intensive outpatient care and outpatient programs. The provider is described as operating across several East Coast states, including Pennsylvania, Virginia, Maryland, North Carolina, New Jersey, Massachusetts and West Virginia.
On November 10, 2026, ransomware-tracking websites listed Pyramid Healthcare as a victim of a group calling itself Vortex. The listing reportedly claims that the group took 60.5 gigabytes of data and set a deadline of November 12, 2026. Cybersecurity blogs and breach trackers repeated the claim, and an industry newsletter described Vortex as a newly active group with little public history.
It is important to be clear about what this is and what it is not. A listing on a leak site is a claim made by the people who say they carried out an attack. It is not a confirmation from the company, and it is not a notice filed with a government regulator. Trackers that republished the listing noted that the claim had not been independently verified. At the time this page was written, Pyramid Healthcare had not publicly confirmed an intrusion, and no breach notice letters or state attorney general filings had been published.
The listing does not describe which kinds of records are involved. It does not say whether the data came from patient files, employee records, billing systems or something else. It also does not say how many people could be affected. For that reason, this page does not state a number of affected people and does not say what information was taken. Anyone reading claims elsewhere that list specific types of data should treat them as unverified unless the company or a regulator confirms them.
Healthcare providers are frequent targets of extortion-style attacks because their records can be sensitive and because disruption to patient care puts pressure on the organization to respond quickly. Behavioral health and addiction treatment records can be especially sensitive, since they may reveal diagnoses, treatment history and other private details. That context applies to the sector in general and is not a confirmed fact about what happened at Pyramid Healthcare.
Federal health privacy rules generally require covered providers to assess whether protected health information was compromised and, if so, to notify the people affected without unreasonable delay and no later than 60 days after discovering the breach. Many states add their own notification rules and may require filings with the state attorney general. If Pyramid Healthcare determines that personal or health information was exposed, patients and employees can expect to receive written notice by mail, and a regulatory filing may follow.
Attorneys working with ClassAction.org have opened an investigation into the reports, and are looking to hear from current and former patients and staff who believe their information may have been put at risk. An investigation of this kind does not mean a lawsuit has been filed, and it does not mean the claim has been proven. It means lawyers are gathering information to evaluate whether legal action may be possible if the incident is later confirmed.
This page relies only on publicly reported information and will be updated if the company issues a statement, a notice letter is made public or a regulator publishes a filing. Until then, the safest approach for anyone connected to Pyramid Healthcare is to stay alert, keep any correspondence from the provider and take the basic protective steps listed below. Affected people are not expected to need to do anything to be included in any future notice; companies generally send letters to the mailing addresses they have on file, so keeping your contact details current with your provider can help.
When Did This Breach Occur?
Ransomware-tracking sites list the claimed attack and the leak-site listing as November 10, 2026, and say the group set a deadline of November 12, 2026. These are dates reported by the tracking sites based on the group’s own listing. Pyramid Healthcare has not publicly confirmed when, or whether, any unauthorized access occurred, and no notice has been published that gives a discovery date or a date range for the incident.
What Information Was Breached?
The listing claims 60.5 gigabytes of data was taken but does not say what types of information that data contains. Pyramid Healthcare has not confirmed that any personal, financial or health information was involved. A class action investigation page about the reports lists the impacted data as still to be determined. If notices are sent, they should state the specific types of information involved for each person, so anyone who receives one should read it closely.
What You Can Do
If you are connected to Pyramid Healthcare and want to be careful, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If you are a current or former patient or employee, keep an eye out for mail from Pyramid Healthcare and do not ignore any notice you receive.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Pyramid Healthcare
Attorneys are investigating the reports about Pyramid Healthcare and want to hear from people who may have been affected, including current and former patients and employees. A lawsuit has not been confirmed, and whether you can seek compensation depends on what the company ultimately discloses. If you received a notice or believe your information was exposed, an attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
