TheraCare, a development and education support organization serving New York, New Jersey and Connecticut, has been named on a ransomware monitoring site. A post dated October 8, 2026 attributes an attack to a group called Storm. The organization has not confirmed a breach.
TheraCare’s Data Breach Investigation
TheraCare is described in public reports as a multispecialty development and education support organization that serves communities in New York, New Jersey and Connecticut. An organization that provides therapy and related support services typically keeps records about the people it serves and the people it employs, which means a security incident can reach clients, families, clinicians and administrative staff alike.
According to a post dated October 8, 2026 on a dark web monitoring site, a ransomware group calling itself Storm claimed responsibility for an attack on TheraCare. The post estimated that the attack took place two days earlier, on or around October 6, 2026. A separate cybersecurity blog also reported that the group had claimed the attack. Both reports rest on the group’s own claim, and neither has been independently verified.
In the sources reviewed for this page, TheraCare has not publicly confirmed that a breach occurred. It has not described how its systems may have been affected, what information may have been taken, or how many people could be involved. We could not find a state attorney general filing, a federal health regulator listing or a notice letter tied to this report.
Claims posted by ransomware groups are not always accurate. Some are exaggerated, some involve data that turns out to be less sensitive than first suggested, and some are later confirmed in formal notices. For that reason, this page reports only what has been claimed and what remains unknown. It does not treat the claim as proof that any particular person’s information was exposed.
Ransomware groups that announce an attack often say they copied files before locking systems, and they may threaten to publish those files if their demands are not met. If that happened here, the kinds of information involved would depend on what was stored on the affected systems. For an organization that delivers developmental, educational and therapy services, that could include enrollment and service records, contact details for families, employment files and payroll information. None of that has been confirmed for TheraCare.
When an organization does confirm an incident, it is generally required to notify the people affected and, in many states, the attorney general. The review of affected files that comes first can take weeks or months, so a formal notice often arrives long after a claim first appears online. Notification rules differ from state to state, and an organization that operates in several states may have to follow more than one set of deadlines.
If you are a current or former client, a family member of a client, an employee or a contractor connected to TheraCare, it is reasonable to watch for a notice and to take basic precautions in the meantime. Because the information involved has not been confirmed, the most useful approach is to stay alert without assuming the worst, and to avoid responding to unexpected messages that ask you to verify personal details.
This page will be updated if TheraCare or a regulator releases more detail. Until then, keep an eye on your financial accounts and credit reports, and be wary of any message that references your relationship with the organization.
When Did This Breach Occur?
A post dated October 8, 2026 on a dark web monitoring site reports that a ransomware group claimed an attack on TheraCare, and estimates that the attack occurred two days earlier, around October 6, 2026. TheraCare has not publicly confirmed the date of any incident, so the actual timeline is not yet known.
What Information Was Breached?
The types of information involved have not been disclosed, and TheraCare has not confirmed that any information was taken. Reports to date describe only the group’s claim. Until the organization or a regulator provides details, no specific category of personal information can be attributed to this incident.
What You Can Do
If you are connected to TheraCare and are concerned about your information, consider these steps:
- Watch your mail and email for a notice from TheraCare, and read it carefully if one arrives, including any offer of credit monitoring.
- Place a free fraud alert on your credit file, or consider a credit freeze, with Equifax, Experian and TransUnion.
- Review your bank, card and insurance statements for charges or claims you do not recognize, and check your credit reports for free at annualcreditreport.com.
- Be cautious of emails, texts or calls that mention the organization or your therapy services and ask for personal details. Report suspected identity theft to the Federal Trade Commission at identitytheft.gov and to your state Attorney General.
File a Data Breach Lawsuit Against TheraCare
If you have been told your information was involved, or you believe it may have been, you may have legal options. Organizations are expected to safeguard the personal information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
