Greater Pittsburgh Orthopaedic Associates Data Breach 2025: 35,000 Affected · RansomHouse Ransomware · Allegheny County Class Action Pending

Greater Pittsburgh Orthopaedic Associates (“GPOA”), a Pittsburgh-area orthopedic practice, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on August 27, 2025, reporting 35,000 affected individuals in a Hacking/IT Incident at a Desktop Computer. GPOA’s own substitute notice and subsequent reporting confirm the practice detected unusual activity on its network on August 10, 2025, and the RansomHouse ransomware group publicly claimed responsibility ten days later. Individual notification letters mailed on or around February 5, 2026 put the final affected population at 56,954, materially larger than the figure on the OCR portal.

Timeline

• 2025-08-10 — detected: GPOA identified unauthorized activity on its computer network and launched an investigation with third-party cybersecurity experts.
• 2025-08-20 — other: The RansomHouse ransomware group added GPOA to its dark-web leak site, claiming responsibility for encrypting files and exfiltrating data from the practice’s network.
• 2025-08-27 — filed: GPOA filed the breach with HHS OCR, reporting 35,000 affected individuals (Hacking/IT Incident; Desktop Computer).
• 2025-08-29 — class-action: Leuch et al. v. Greater Pittsburgh Orthopaedic Associates, Inc., No. GD-25-009211, was filed in the Allegheny County Court of Common Pleas.
• 2025-10-21 — other: The court granted plaintiffs’ motion to consolidate related actions and appointed Benjamin F. Johns of Shub Johns & Holbrook LLP as interim co-lead counsel.
• 2026-02-05 — notified: GPOA began mailing individual notification letters identifying names, mailing addresses, Social Security numbers, and provider names as the data at issue.
• 2026-02-20 — other: Notice was filed with the Vermont Attorney General; subsequent press coverage and the entity’s letters identified an updated affected-individual count of 56,954.

What was exposed

Per GPOA’s individual notification letter and the Vermont Attorney General filing, the categories of information that may have been compromised include:

• Names
• Mailing addresses
• Social Security numbers
• Provider names

GPOA’s letter notes that the specific data elements affected varied by individual.

What the entity is offering

GPOA is offering all affected individuals complimentary single-bureau credit monitoring, credit reports, and credit score services for 24 months through Cyberscout, a TransUnion company. Enrollment requires a unique code provided in the individual notification letter. GPOA has also stated that it engaged third-party cybersecurity experts to investigate the incident and harden its network.

Class-action posture

A proposed class action, Leuch et al. v. Greater Pittsburgh Orthopaedic Associates, Inc., No. GD-25-009211, was filed in the Allegheny County Court of Common Pleas on August 29, 2025. On October 21, 2025, the court granted plaintiffs’ motion to consolidate related actions and appointed Benjamin F. Johns, Partner at Shub Johns & Holbrook LLP, as interim co-lead counsel. A consolidated amended complaint was due November 21, 2025. Additional firms including Lynch Carpenter LLP and Migliaccio & Rathod LLP have publicly announced investigations into claims on behalf of affected patients.

What to do

• Freeze your credit at all three nationwide consumer reporting agencies. With Social Security numbers in scope, a freeze is the single highest-leverage protective step against new-account identity theft.
• Enroll in the offered Cyberscout monitoring using the unique code in your GPOA notification letter. Twenty-four months of single-bureau monitoring is meaningful but does not replace a credit freeze.
• Watch for the GPOA notification letter at the address on file with the practice. The letter identifies which specific data elements were exposed for you and contains your unique enrollment code.
• Be alert to medical-identity-theft signals. Provider names were in scope, which increases targeted phishing risk. Review explanation-of-benefits statements from your health insurer for services you did not receive.

Sources

• HHS Office for Civil Rights Breach Portal — federal regulatory record (35,000 affected; filed 2025-08-27; Hacking/IT Incident; Desktop Computer).
• DataBreaches.net — GPOA disclosed a 2025 breach — reconciliation of OCR 35,000 figure with the 56,954 final notification population and notification-timing analysis.
• HIPAA Journal — Greater Pittsburgh Orthopedic Associates Data Breach — detection date, notification mail date, data elements, RansomHouse attribution, Cyberscout credit-monitoring offer.
• Vermont Attorney General — 2026-02-20 GPOA Data Breach Notice to Consumers — state-AG filing of the consumer notice.
• Shub Johns & Holbrook LLP — Benjamin F. Johns Appointed Interim Co-Lead Counsel — case caption, docket number, court, filing date, and consolidation/leadership order.
• ClassAction.org — GPOA Data Breach Investigation — RansomHouse claim and plaintiff-firm investigation status.
• Paubox — GPOA hit by RansomHouse threat group — independent reporting on RansomHouse attribution and incident response.