In November 2026, cybersecurity trackers and law firm notices reported that the Brain Cipher ransomware group claimed responsibility for a cyberattack against Spear Physical Therapy. The threat actors alleged they exfiltrated approximately 40 gigabytes of files containing internal company data and patient records. As of November 2026, Spear Physical Therapy had not issued an official public statement or confirmed the authenticity of the alleged intrusion.
The specific data types and the number of individuals affected remain unverified by official sources. Reports indicate the compromised material allegedly includes patient health records, health insurance information, government identification scans, full names, addresses, and demographic details. Official breach filings with state attorneys general or the federal government have not yet appeared on public portals.
Because the incident stems from an unconfirmed extortion claim, details surrounding the scope and validity of the event may change. Verified confirmation and affected numbers typically emerge only after internal forensic investigations conclude and formal regulatory notices are filed.