Step By Step, a Pennsylvania agency supporting people with disabilities, is the subject of an unconfirmed report of a data breach. A hacker group called Storm reportedly claimed an attack on October 3, 2026.
Step By Step’s Data Breach Investigation
Step By Step is described in public reporting as an agency that provides vocational, housing and clinical support to individuals with disabilities across Pennsylvania. Organizations in this field work closely with people and families, and they keep detailed records on those they support and on their staff. That can include contact details, identity documents, benefits and funding information, and health and care records.
The possible incident first surfaced through monitoring of criminal activity online rather than through a notice from the organization. An October 3, 2026 post on the dark web monitoring site Ransomware.live reported that a hacker group calling itself Storm was behind a suspected attack, and that the attack was estimated to have happened the day before. A second cybersecurity platform, DeXpose, reportedly also said that Storm claimed responsibility for an attack on Step By Step.
It is important to be clear about how little is confirmed. These are claims by a criminal group as relayed by monitoring sites. We did not find a statement from Step By Step confirming that an attack occurred, describing what systems were affected, or saying whether any personal information was taken. We did not find a regulator filing or a notice letter, and the number of people potentially affected has not been published. We are not estimating one, and we are not stating which kinds of information may be involved, because no source we reviewed says.
Claims posted by hacker groups are sometimes accurate and sometimes exaggerated or false, and the timing of a claim does not by itself show when anything was accessed. If the organization does confirm an incident, it may be legally required to notify the people affected and, depending on the type of data involved, to report to state regulators or to federal health privacy authorities. Those notices typically appear weeks or months after an incident is first discovered, which is why people sometimes learn about a possible breach through the news before they hear from the organization itself.
For people connected to an organization like this one, the potential consequences deserve attention even while facts are unsettled. Records about people receiving disability services can include highly sensitive details, and families and employees may also be named in them. If information were taken and published or sold, it could be used for identity theft, fraudulent benefits claims, or targeted scams that reference real details about a person’s care or living situation. This is general background about this kind of incident, not a confirmed statement about what happened here.
If you are a current or former employee, a person who has received support from Step By Step, or a family member of someone who has, there is no need to panic, but it makes sense to be careful. Watch for any official notice by mail or email, and be wary of messages that claim to come from the organization and ask you to click a link or provide personal information. If you want to confirm whether the organization has made an announcement, use contact information you find on your own, not details in an unexpected message.
Reports of this kind often leave people with more questions than answers. A claim may be about files taken from a single computer, an email account, or an entire network, and the difference matters a great deal for who is affected. Until the organization says more, it is not possible to know whether any individual’s information was involved. Keeping a record of when you first heard about the report and any unusual messages you later receive can be useful if a confirmed notice does arrive.
This page will be updated if Step By Step or a regulator publishes more information. The sections below summarize what is known about timing and the data involved, and set out steps you can take now, along with how to reach a lawyer if you want to understand your legal options.
When Did This Breach Occur?
According to an October 3, 2026 post on Ransomware.live as reported by ClassAction.org, the suspected attack was estimated to have occurred on the previous day. Step By Step has not publicly confirmed any dates, so the timing is an unverified estimate.
What Information Was Breached?
The type of information involved has not been disclosed. No notice or confirmation from Step By Step was found, and the reports we reviewed do not say what data, if any, was taken. If you receive a notice, rely on it for what applies to you.
What You Can Do
If you are connected to Step By Step, consider these steps:
- Watch for any official notice by mail or email, and keep a copy if you receive one.
- Check your credit reports for free at annualcreditreport.com and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Review bank, card, insurance and benefits statements for anything you do not recognize, and report it right away.
- Be cautious with unexpected calls, texts or emails that mention Step By Step, and do not click links or share personal details with unsolicited contacts.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against Step By Step
If you are affiliated with Step By Step and believe your information may have been put at risk, you may have legal options. Organizations are expected to protect the sensitive information they hold, and a lawsuit can help hold an organization accountable if it is later confirmed that it fell short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
