Pavillon Data Breach Exposes PHI and PII for Thousands of Individuals

Pavillon International Inc., a nonprofit addiction treatment provider based in Mill Spring, North Carolina, disclosed a data breach involving sensitive personal and health information. So far, the incident has impacted 3,102 South Carolina residents and 19 Massachusetts residents.

On July 31, 2026, Pavillon was alerted to suspicious activity within its computer network. An investigation that followed found that an unauthorized actor had accessed portions of Pavillon's network and that some data had been taken without authorization.

A ransomware group calling itself Global Secret Group claimed responsibility for the attack. The group posted on the dark web on Aug. 5, 2026, claiming to have obtained 646 GB of the organization's data. The compromised data reportedly included patient records, treatment information, employee records, internal corporate documents, financial information and other sensitive healthcare data.

The types of personal and protected health information confirmed as exposed in the breach included names, Social Security numbers, driver's license numbers, financial account information, demographic information, health insurance information and medical diagnostic and treatment information.

The breach was disclosed to the attorneys general of Massachusetts and South Carolina starting on Sept. 29, 2026. The company additionally posted a notice of the incident on its website on the same date.

Pavillon International Inc.'s response to the breach

The company is offering 12 to 24 months of complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company. Recipients must enroll within 90 days of receiving their notification letter.

Pavillon has set up a dedicated assistance line at 1-833-516-8785, available Monday through Friday from 8 a.m. to 8 p.m. EST, excluding major U.S. holidays.