Step By Step Data Breach: A Ransomware Claim, No Lawsuit Yet
Reference Guide
Step By Step, Inc. is a Wilkes-Barre nonprofit that supports people with intellectual disabilities, autism and mental health needs across Pennsylvania. On October 3, 2026 a ransomware group listed it as a victim. As of October 19, 2026 the organization has not publicly confirmed a breach, no notice letters have surfaced, and no step by step data breach lawsuit has been filed that we can find. There is no settlement and no claim form.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What Has Actually Been Reported
Everything known so far comes from the attackers' side. Ransomware tracker Ransomware.live recorded Step By Step (stepbystepusa.com) on the leak site of a group called Storm on October 3, 2026, with an estimated attack date of October 2, 2026. The group's posted statement threatens that “the full leak will be published soon” unless the organization contacts it.
That is a claim, not a confirmed breach. Trackers only repeat what criminals post; they do not see the data. As of October 19, 2026, Step By Step has not publicly confirmed an incident, which data types may be involved is unknown, and no count of affected people has been published. The organization's homepage carried no incident notice when we checked.
Who could be affected if the claim holds: Step By Step says it serves over 2,000 individuals in more than a dozen Pennsylvania counties — Northeast, Lehigh Valley, Southeast and Greater Pittsburgh — plus its staff. Records at an agency like this can include identity, benefits and care information.
Case details
No lawsuit has been filed that we can find. Our database of federal district court filings, which tracks new cases from all federal courts since October 10, 2026, shows 0 cases against Step By Step as of October 19, 2026. We could not search Pennsylvania state court dockets, so a state filing cannot be ruled out.
What exists is a lawyer-referral investigation page published October 5, 2026, saying attorneys are looking into whether a class action can be filed. That is advertising for clients, not a case. A real case would have a court name, a case number and a filing date — none exist yet.
Status: Unconfirmed Claim, No Case, No Settlement
The next real milestone would be an official notice. Under Pennsylvania's amended breach law, in effect since September 26, 2024, an organization that notifies more than 500 Pennsylvania residents must notify the state Attorney General at the same time, including the estimated number affected. If Social Security, bank account or driver's license numbers were taken, it must also offer 12 months of free credit monitoring. Until a letter like that arrives, nobody can tell you whether your data was involved.
Could My Information Be Involved?
Possibly, if you are a current or former person supported by Step By Step, a family member or guardian on file, or a current or former employee. But there is no class and nothing to join today.
The practical test is your mail. If the claim is confirmed, a notice letter would state which of your data fields were involved and what free services are offered. Keep that letter and its envelope. If you never receive one, that is not proof either way while the investigation is unfinished.
A separate Pennsylvania behavioral-health provider case is covered on our COMHAR data breach page.
Is There Money?
Step By Step Breach Timeline
October 2, 2026 — Estimated Attack Date
Ransomware.live estimates the attack on Step By Step took place on this day, based on the group's own posting.
October 3, 2026 — Storm Lists Step By Step
The ransomware group Storm posts Step By Step on its leak site and threatens to publish data unless the organization makes contact.
October 5, 2026 — Trackers and Lawyer Ads Follow
Breach trackers log the claim with leak size unknown. A lawyer-referral site publishes an investigation page; no case is filed.
October 10, 2026 — Federal Filings Monitored
Our tracking of new federal district court filings begins. No Step By Step case appears through October 19, 2026.
Pending — Official Notice
If more than 500 Pennsylvania residents are notified, the state Attorney General must be told at the same time. No notice has surfaced.
October 19, 2026 — No Case, No Settlement
No confirmation from Step By Step, no lawsuit, no fund, no claim form and no deadline.
Three Things to Watch For
An unconfirmed breach at an agency serving vulnerable people is an easy target for imposters:
“Your data was leaked — verify your identity” messages
Storm threatened to publish data, which gives scammers a story. A text or call claiming to be Step By Step, a county office or a “breach response team” and asking for a Social Security number is a red flag. The FTC notes the IRS, banks and employers will not call, email or text to ask for it.
“Claim your Step By Step settlement” pages
There is no settlement and no claims portal. Any site asking for your details or a fee to “secure your share” is collecting data, not filing a claim.
Calls targeting guardians and families
Callers may name a group home or a caseworker to sound legitimate and ask about benefits or Medicaid numbers. Hang up and call the agency or your county office using a number you already have.
Step By Step Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Was Step By Step really hacked?
Unconfirmed. A ransomware group called Storm claimed the attack on October 3, 2026. As of October 19, 2026, Step By Step has not publicly confirmed an incident, and trackers list the leak size and data types as unknown.
Is there a step by step data breach lawsuit?
Not that we can find as of October 19, 2026. Our federal filing database shows 0 cases, and the only legal activity is a lawyer-referral page from October 5, 2026 saying attorneys are investigating whether to sue. State court filings could not be checked.
How many people were affected?
Unknown. No count has been published and no Attorney General filing has surfaced. Step By Step says it serves over 2,000 individuals, plus staff, but that is the size of the organization, not a breach figure.
What data was exposed?
Not confirmed. Neither the organization nor the trackers have listed specific data types. If notices go out, each letter will state which fields applied to you.
How much money do you get from a data breach settlement?
In this case, nothing today: there is no settlement, no fund and no claim form. Amounts in other cases depend on the data taken and the class size; our payout calculator explains how a fund is divided.
Will I be notified if my data was involved?
Pennsylvania law requires notice to affected residents. If more than 500 Pennsylvanians are notified, the Attorney General must be notified at the same time, and if Social Security, bank account or driver's license numbers were exposed, 12 months of free credit monitoring must be offered.
What steps should you take in case of a data breach?
Place a credit freeze at Experian, TransUnion and Equifax — the FTC says it is free to place and lift. You can also add a free one-year fraud alert through one bureau. Review your bank statements and credit reports, and keep any notice letter you receive.
Do I need to sign up somewhere to be included?
No. There is no case or class to join. If a class action is filed and later certified or settled, class members are notified directly by a court-appointed administrator. Signing with a law firm is a separate, optional choice — read what you sign.
About This Information
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated - $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Open Class Action SettlementsSettlements currently accepting claims, with deadlines
- Data Breach Settlement CalculatorEstimate what comparable breach settlements have paid
- Settlement Payout CalculatorHow a fund gets divided among class members
- Consequences of a Data BreachWhat exposed data can be used for and how to respond