On July 31, 2026, Pavillon International Inc., a nonprofit organization specializing in mental health care and addiction treatment, detected suspicious activity within its computer network. Steps were taken to secure systems and engage external cybersecurity specialists. By August 7, 2026, it was confirmed that an unauthorized actor had accessed parts of Pavillon’s network and exfiltrated sensitive data.
The ransomware group GLOBAL SECRET GROUP claimed responsibility for the attack on August 5, 2026, stating they obtained 646 GB of data. The exposed data types include names, driver's licenses, social security numbers, demographic information, financial account information, medical records, and health insurance information. The breach affected thousands of individuals, with 19 reported in Massachusetts and 3,102 in South Carolina.
Additional details about the incident, including further affected individuals or specific details of exposure, may emerge as the investigation continues. Official notifications to affected parties are often a phased process.