Boston Orthotics & Prosthetics Hit by Anubis Ransomware Attack in June 2026 Boston Orthotics & Prosthetics (Boston O&P), a leading provider of pediatric orthotic and prosthetic care, was targeted in a ransomware attack claimed by the Anubis cybercriminal group in late June 2026. The incident, posted to the group’s data leak site on June 29, 2026, may have exposed protected health information (PHI) and personal data of pediatric patients and their families across multiple clinic locations. Boston O&P, headquartered in Avon, Massachusetts, operates clinics in Massachusetts, Pennsylvania, New Jersey, Maryland, and other states, specializing in non-surgical treatments for conditions such as scoliosis, plagiocephaly, cerebral palsy, and neuromuscular disorders. The company partners with major medical facilities, including Boston Children’s Hospital and Children’s Hospital of Philadelphia, and was acquired by OrthoPediatrics Corporation in 2024. Anubis, a financially motivated ransomware group, has claimed 35 attacks in 2026, with 17 targeting U.S. healthcare organizations. The group employs double-extortion tactics, stealing data and threatening to leak it unless ransom demands are met. While the exact scope of the breach remains undisclosed, pediatric orthotic and prosthetic records typically include names, addresses, dates of birth, Social Security numbers, insurance details, medical histories, diagnoses, treatment information, and clinical imaging. As of this report, Boston O&P has not issued a public statement confirming the attack or outlining its response. Under HIPAA and Massachusetts data breach laws, affected healthcare providers must notify individuals, the U.S. Department of Health and Human Services, and potentially the media within specified timeframes. Legal firms, including Almeida Law Group, are reviewing potential remedies for affected patients. The breach underscores the ongoing threat ransomware groups pose to healthcare providers, particularly those handling sensitive pediatric data.