Spear Physical Therapy, a provider of outpatient physical and occupational therapy in New York City and the surrounding area, is named on the leak site of a ransomware group. The group claims it took patient records and other files, and the company has not confirmed that any breach occurred.
Patients trust therapy providers with health and insurance details. This page summarizes what has been reported so far and what you can do while the facts are sorted out.
Spear Physical Therapy’s Data Breach Investigation
On or around November 4, 2026, dark web monitoring services noticed that a ransomware group calling itself Brain Cipher had listed Spear Physical Therapy on its leak site. Leak sites are where such groups post the names of organizations they say they have attacked, often to pressure them into paying. The listing is the only public source of information about this incident so far.
According to monitoring reports, the group claims to have stolen 40 GB of files. Those are said to include patient information and internal company records, among them health records and scans of government-issued identification. These are claims made by criminals, and they have not been independently verified. Groups of this kind sometimes exaggerate what they took, and sometimes the data turns out to be real.
As of November 5, 2026, Spear Physical Therapy had not confirmed the claim or said whether its systems were affected. No notice letters have been reported, and no regulator filing has been found. Because of that, nothing is known publicly about how many people may be affected, which patients or former patients are involved, or whether the data in the group’s possession is genuine.
Health care providers are frequent targets for ransomware because their records are valuable and they cannot easily go without their systems. If a provider is attacked, the usual sequence is that the organization investigates, works out whose information was involved, and then mails notices. Under federal health privacy rules and state laws, those notices generally have to go out within a set period after the provider confirms a breach, so notices, if any are required, may not arrive for some time.
If the claim turns out to be accurate, the kinds of information that a therapy provider holds could include names, contact details, dates of birth, insurance information, and details about treatment, diagnoses or injuries. The claim itself also mentions government ID scans, which could be used to impersonate someone. This is general background about what providers of this type typically keep, and it is not a confirmed list of what was taken from Spear.
Health information is difficult to replace once it is exposed, and it can be used for medical identity theft, where someone obtains care or files insurance claims in another person’s name. Details about a person’s injuries or conditions can also be used in convincing scam messages that appear to come from a provider or insurer.
Current and former patients do not need to wait for a letter to take basic precautions. Review explanation-of-benefits statements from your health insurer for care you did not receive, be careful with unexpected calls, texts or emails that mention your treatment, and consider a free credit freeze. These steps cost nothing and are useful whether or not the claim proves accurate.
If Spear Physical Therapy later confirms an incident, publishes a notice, or files with a regulator, those sources will be the most reliable basis for understanding the scope. Until then, this page reflects only what has been publicly reported, and it will be most useful as a place to learn what to watch for.
When Did This Breach Occur?
The group’s listing was reported by monitoring services on or around November 4, 2026. The date when any intrusion took place, and the date Spear Physical Therapy learned of it, have not been disclosed.
Ransomware groups often post a company’s name days or weeks after an attack begins, so the listing date may not match the date of any actual intrusion. A notice from the company, if one is sent, would be the best source for the real timeline.
What Information Was Breached?
Brain Cipher claims the files include patient information, health records, government ID scans and internal company information. Spear has not confirmed any of this.
Until the company says what was involved, the specific data types are unknown. If you receive a notice from Spear, it should state which items related to you.
What You Can Do
If you are a current or former patient of Spear Physical Therapy, or you receive a notice from the company, consider these steps:
- Keep any notice you receive, along with details of any credit monitoring or identity protection it offers.
- Place a free fraud alert or credit freeze with Equifax, Experian and TransUnion, and get your credit reports free at annualcreditreport.com.
- Review your health insurance explanation of benefits and your bank and card statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention your treatment or this incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Spear Physical Therapy
If your information was involved in an incident at Spear Physical Therapy, you may have legal options. A data breach lawsuit can seek compensation for the loss of privacy, the time spent protecting yourself and any out-of-pocket costs, and can press a provider to improve how it safeguards patient information. Whether a claim makes sense depends on the facts, which are still unconfirmed here. Keep any notice you receive and any records of suspicious activity or expenses, since they may matter later.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
