Rimrock Foundation, a Montana addiction treatment nonprofit, has been named by a ransomware group as a victim of an attack. The organization has not confirmed a breach. Treatment providers hold some of the most sensitive records there are.
Rimrock Foundation’s Data Breach Investigation
Rimrock Foundation is a nonprofit addiction treatment organization based in Montana that offers inpatient and outpatient programs, counseling and specialized therapies for adults dealing with substance use and co-occurring mental health conditions. According to a ransomware tracking site, a group calling itself INC Ransom listed Rimrock Foundation on its leak site on October 1, 2026, and the estimated attack date shown is the same day. A legal-news aggregator that follows data breach investigations also reports that attorneys are looking into the hacker group’s claims.
Those listings are the only public information available at this point. Rimrock Foundation has not publicly confirmed that a breach occurred, and we have not seen a breach notice, a filing with a state Attorney General or a statement from the organization describing what systems or records were affected. The types of information involved and the number of people affected have not been disclosed. Nothing on this page should be read as confirmation that any person’s information was taken.
A listing on a ransomware leak site is a claim made by the group that posted it. Groups of this kind often name a victim to pressure it into paying, and they may later publish files they say they copied. Some claims turn out to be accurate and others are overstated, so it can take weeks or months for an organization to finish its own investigation and tell the public what happened.
The kind of organization involved matters. Addiction treatment providers keep intake and assessment records, treatment and counseling notes, medication information, insurance and billing details, and the contact information of patients and their families. Records that relate to substance use treatment can carry additional legal protections under federal privacy rules, and exposure of this kind of information can cause real harm beyond financial fraud, including embarrassment, discrimination and harassment. We do not know which categories of information, if any, were involved here, and we are not guessing.
If Rimrock Foundation does confirm that personal information was involved, state data breach laws generally require notice to affected individuals within set deadlines, and many states also require notice to the Attorney General when a certain number of residents are affected. Federal health privacy rules can also require notice to patients and to the Department of Health and Human Services when protected health information is exposed. Notification letters usually explain what happened, what information was involved, what the organization is doing about it and what steps a person can take.
Identity and health details can support fraud such as opening accounts in another person’s name, submitting false insurance claims, or sending convincing phishing messages that reference a real treatment relationship. These are general risks associated with this kind of incident, not confirmed facts about what happened to any individual’s data here.
We will update this page if Rimrock Foundation or a regulator publishes more detail, such as the dates of any incident, the data types involved or the number of people notified. If you are a current or former patient, family member or employee, there is no need to wait for a letter before taking basic precautions, such as reviewing your statements and explanation-of-benefits notices and considering a fraud alert or credit freeze.
When Did This Breach Occur?
The ransomware group’s listing was reportedly discovered on October 1, 2026, and the estimated attack date shown on the tracking site is the same day. Rimrock Foundation has not confirmed the dates of any incident.
What Information Was Breached?
The specific types of information involved have not been disclosed, and the organization has not confirmed that any information was taken. Treatment providers can hold names, contact details, insurance and billing information, and clinical records. Which of these, if any, were involved here is unknown.
What You Can Do
If you are a current or former patient, family member or employee of Rimrock Foundation, consider these steps:
- Watch your mail and email for any notification from Rimrock Foundation and keep it for your records.
- Review your bank and card statements and your health insurance explanation-of-benefits notices for anything you do not recognize.
- Check your credit reports for free at annualcreditreport.com and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Be cautious of calls, texts and emails that mention your treatment, billing or insurance, and avoid clicking links in unexpected messages.
- Report suspected identity theft to the Federal Trade Commission and your state Attorney General.
File a Data Breach Lawsuit Against Rimrock Foundation
If you received a notice that your information may have been involved in a Rimrock Foundation data breach, or you believe your information was put at risk, you may be entitled to compensation. Healthcare and treatment providers are expected to take reasonable steps to protect patient records, and people affected by a breach can face a lasting risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
