GPOA Data Breach Exposes Personal and Health Information of Nearly 57,000 Individuals On February 26, 2026, Greater Pittsburgh Orthopedic Associates (GPOA), a Pennsylvania-based orthopedic medicine provider, disclosed a cybersecurity incident that compromised the sensitive data of approximately 57,000 individuals. The breach involved unauthorized access to GPOA’s network, potentially exposing personally identifiable information (PII) and protected health information (PHI), including names, Social Security numbers, mailing addresses, and provider details. The law firm Lynch Carpenter, LLP, has launched an investigation into potential claims against GPOA related to the incident. The firm, which specializes in data privacy litigation, is reviewing cases for affected individuals who may be eligible for compensation. GPOA has not yet provided further details on the timeline of the breach or the methods used by the unauthorized party. The incident underscores the ongoing risks to healthcare providers handling sensitive patient data.

Greater Pittsburgh Orthopaedic Associates Hit by Suspected Ransomware Attack in 2025 Greater Pittsburgh Orthopaedic Associates (GPOA) recently disclosed a cybersecurity breach affecting tens of thousands of patients, with evidence pointing to a ransomware attack by the group RansomHouse. The incident, which occurred on or around August 10, 2025, was first flagged when RansomHouse added GPOA to its dark web leak site on August 20, 2025, claiming the organization’s systems had been encrypted and data exfiltrated. Proof of the breach was provided, though the group never updated its listing, leaving uncertainty over whether stolen data was sold or leaked. GPOA reported the breach to the U.S. Department of Health and Human Services (HHS) on August 27, 2025, initially citing 35,000 affected patients. However, in a February 20, 2026, filing with the Maine Attorney General’s Office, the organization’s external counsel revised the number to 56,954 individuals, though it remains unclear whether this includes non-patients or reflects the final tally. The HHS breach tool has not been updated, and the agency’s investigation remains open. Patient notifications were delayed until February 5, 2026, when letters were mailed out. The disclosure confirmed that exposed data may have included names, mailing addresses, Social Security numbers, and provider names though GPOA made no mention of ransomware or extortion attempts in its communications. As a remedial measure, the organization arranged credit monitoring and credit score services through Cyberscout for affected individuals. The 2025 incident may not have been GPOA’s first cybersecurity compromise. In May 2024, a threat group known as DonutLeaks (or variations of the name) claimed to have targeted "Pittsburgh’s Trusted Orthopaedic Surgeons" a branding used by GPOA on a dark web leak site. The group’s listing later went offline, and GPOA did not publicly acknowledge the claims. The alleged 2024 breach does not appear on HHS’s public records, raising questions about whether it was reported or if data was leaked. GPOA has not responded to inquiries about either incident, including requests for clarification on the 2025 attack’s scope and its response to the 2024 claims. As of publication, it remains unclear whether the organization experienced two separate cyberattacks in the past two years or if data from either was sold or exposed. The lack of transparency and delayed disclosures have left affected patients with lingering uncertainties.