Rimrock Foundation Data Breach: A Ransomware Claim, No Lawsuit Yet
Reference Guide
On October 1, 2026 the ransomware group INC Ransom listed Rimrock Foundation — the Billings and Bozeman, Montana addiction treatment center — as a victim on its leak site. As of October 14, 2026, Rimrock has not published any confirmation we could find, nobody knows what data was taken or how many people are affected, and no Rimrock Foundation data breach lawsuit has been filed in federal court. Lawyers are advertising “investigations”. That is all there is so far.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Rimrock is a nonprofit that describes itself as the largest drug and alcohol addiction treatment center in the region, with detox, day treatment, intensive outpatient care, DUI classes, treatment courts and medication-assisted treatment in Billings and Bozeman.
On October 1, 2026, dark-web monitoring services recorded a post by INC Ransom claiming an attack on rimrock.org. The group claims it has “obtained confidential data” and threatens to publish it unless Rimrock makes contact. That is the attacker's claim, not a verified fact. A second tracker logged the listing on October 2, 2026, with the leak size “unknown.”
What makes this Rimrock Foundation data breach potentially serious is the kind of provider involved: addiction and mental-health treatment records are among the most sensitive records a person has.
Case details
No lawsuit has been filed that we can find. A search of federal court records (CourtListener) for “Rimrock Foundation” on October 14, 2026 returned 22 results, all older, unrelated cases in the District of Montana — none about data security. Our feed of new federal filings in every district since October 10, 2026 shows no Rimrock case either. Montana state-court filings are not indexed in those systems, so a state-court complaint cannot be ruled out. What does exist is a ClassAction.org page, published October 1, 2026, saying attorneys are investigating and inviting current and former patients and staff to come forward. An investigation page is an advertisement, not a court case.
Status: Unconfirmed Breach, No Case, No Settlement
Who Could Be Affected
Nobody has defined that yet. The people with records at Rimrock are current and former patients, family members involved in treatment, and current and former staff — and the law-firm pages are soliciting exactly those groups. Until Rimrock or a regulator says whose data was involved, no one can tell you whether you are affected.
The rules on notice are clear, though. If patient health information was breached, HIPAA requires Rimrock to notify each affected person without unreasonable delay and in no case later than 60 calendar days after discovering the breach, and to report a breach of 500 or more people to the U.S. Department of Health and Human Services at the same time. Montana law (MCA 30-14-1704) separately requires notice to affected Montana residents and a copy to the Attorney General's consumer protection office, stating how many residents were notified.
Is There Any Money?
Rimrock Foundation Breach Timeline
October 1, 2026 — Ransomware Group Claims an Attack
INC Ransom lists rimrock.org on its leak site and claims it took confidential data, threatening publication. Monitoring services estimated the attack occurred the same day.
October 1, 2026 — Law Firms Start Advertising
A ClassAction.org page appears, saying attorneys are investigating and inviting Rimrock patients and staff to come forward. It lists the affected data as “TBD.”
October 2, 2026 — Second Tracker Logs the Claim
A breach tracker records the INC Ransom claim against Rimrock with the leak size listed as unknown.
Up to 60 Days After Discovery — HIPAA Notice Deadline
If Rimrock confirms that patient information was breached, individual notice letters are due within 60 calendar days of discovery. The discovery date has not been published.
October 14, 2026 — Still No Confirmation or Lawsuit
No public statement from Rimrock that we could find, no federal lawsuit, no settlement and no claim form.
Three Things to Watch For
Treatment records are leverage, and an unconfirmed breach with no official information is the perfect cover:
Messages that mention your treatment and ask for money
Anyone who contacts you about your Rimrock treatment and demands payment to keep it private is attempting extortion. Do not pay or reply; report it to the FBI at ic3.gov and tell Rimrock using the phone number on its own website, (800) 227-3953.
“Claim your Rimrock settlement” pages
There is no settlement and no claim form. A page asking for your Social Security number or treatment dates to “secure your payment” is collecting data, not filing a claim.
“Join the Rimrock lawsuit now” ads
There is no lawsuit to join. Investigation ads are sign-ups with a law firm. That is a legitimate choice, but it is a retainer decision — read what you sign rather than treating it as registration.
Rimrock Foundation Data Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
What happened in the Rimrock Foundation data breach?
On October 1, 2026 the ransomware group INC Ransom claimed on its leak site that it had attacked Rimrock Foundation and taken confidential data. As of October 14, 2026, Rimrock has not published a confirmation that we could find, and no details on the scope have been released.
Is there a Rimrock Foundation data breach lawsuit?
Not that we can find. A federal court records search on October 14, 2026 showed only older, unrelated cases, and our feed of new federal filings shows nothing. Law firms are advertising investigations, which are not lawsuits. Montana state courts are not covered by those searches.
What data was taken, and how many people are affected?
Unknown. Neither figure has been published. The attackers claim to hold “confidential data,” but that is their claim. A notice letter from Rimrock would list the data types for your record; a filing with Montana's Attorney General would state how many Montanans were notified.
When would patients be notified?
If patient health information was breached, HIPAA requires notice no later than 60 calendar days after Rimrock discovered the breach. If 500 or more people are affected, the breach must be reported to HHS at the same time and will appear on the HHS breach portal.
How to check if there is a data breach?
Watch your mail for a notice letter from Rimrock — it is the primary proof. You can also check the Montana Department of Justice list of reported data breaches and the HHS breach portal for healthcare breaches of 500 or more people.
How much can I get from a data breach settlement?
From Rimrock, nothing today — there is no settlement. Amounts in other cases depend on the fund size, the number of claimants and whether you can document losses. Our payout calculator explains the math; the Equifax figures people search for belong to a different case, covered on our Equifax page.
Is a letter or email about the Rimrock breach real?
A real notice comes from Rimrock or a vendor it names, explains what happened, and does not ask for payment or your full Social Security number. If in doubt, call Rimrock at (800) 227-3953 or (406) 248-3175 — the numbers on its own website, not the ones in the message.
What is worth doing right now?
Freeze your credit at all three bureaus — free and reversible. Watch your health insurer's explanation-of-benefits statements for care you never received. Keep any letter you receive from Rimrock, and do not respond to anyone who references your treatment and asks for money.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Open Class Action SettlementsSettlements you can file a claim in right now
- Settlement Payout CalculatorHow a fund is split among class members who file
- Aesto Health Data Breach LawsuitA healthcare vendor breach with lawsuits already filed