Olympia Orthopaedic Associates Data Breach

A ransomware group says it stole and posted data from Olympia Orthopaedic Associates, including patient medical information. As of October 27, 2026, the practice has not told patients.

Olympia Orthopaedic Associates, PLLC is an independent orthopaedic practice in Thurston County, Washington. It was founded in 1972. On October 21, 2026, a ransomware group called Brain Cipher listed the practice’s website, olyortho.com, on its leak site, according to ransomware tracking services. The group claims it took about 105 GB of data, or about 146,000 files.

Brain Cipher has since posted data it says came from the practice. Olympia Orthopaedic Associates has not posted a public notice on its website. No filing with the Washington Attorney General or the U.S. Department of Health and Human Services (HHS) could be found as of October 27, 2026.

Who Is Brain Cipher?

Brain Cipher is a ransomware group that has been active since mid-2024. Ransomware is software that locks a victim’s files until a ransom is paid. Brain Cipher uses a method called double extortion. That means the group steals data first, then locks the systems. If the victim does not pay, the group publishes the stolen data online.

The group has targeted healthcare before. In 2026, it claimed an attack on Baltimore Medical System, according to Paubox.

Source: Paubox, Baltimore Medical System hit by ransomware group Brain Cipher

No Public Notice Yet

Six days after the leak-site listing, Olympia Orthopaedic Associates had not announced the incident. Washington law generally requires a business to notify affected Washington residents within 30 days of discovering a breach. If more than 500 Washington residents are affected, the business must also notify the Washington Attorney General within 30 days, according to the Attorney General’s Office.

Health care providers may also have duties under federal HIPAA rules to notify patients and HHS. Olympia Orthopaedic Associates has not said when it learned of the attack or how many people are affected.

Source: Washington Attorney General, Data Breach Resource Center

What Information Was Exposed?

The practice has not confirmed what data was taken. Brain Cipher claims the stolen data includes:

• Patient medical information
• Employee human resources (HR) records
• Legally privileged materials
• Email
• Operational and technical documents

These are the group’s claims. They have not been confirmed by the practice. The practice has not said which details were exposed for each patient.

Which Locations Are Involved?

Olympia Orthopaedic Associates serves patients across the South Sound. Its locations include:

• Westside Clinic, ROC Urgent Clinic and Olympia Surgery Center (Olympia)
• Eastside Clinic (Olympia)
• Spine Clinic (Olympia)
• Hawks Prairie Clinic and Surgery Center (Lacey)
• Centralia Clinic (Centralia)

The practice offers hand, shoulder, spine, hip, knee and foot care, plus pain management, sports medicine, podiatry, physical therapy, imaging and outpatient surgery. It has not said which locations or patient groups were affected.

What Is Olympia Orthopaedic Associates Offering?

Nothing has been announced yet. The practice has not offered credit monitoring or identity protection as of October 27, 2026. Patients who receive a notice letter later should read it closely for any offer and enrollment deadline.

Your Information Is at Risk

Medical records can be more valuable to criminals than credit card numbers. A credit card can be canceled. A medical history cannot be changed. Stolen health data can be used for medical identity theft, insurance fraud or targeted scams. Employee HR records often include Social Security numbers and bank details for direct deposit.

Affected individuals can take steps now:

• Review explanation of benefits (EOB) statements from health insurers for care that was never received
• Place a free credit freeze with Equifax, Experian and TransUnion
• Watch bank and credit accounts for unusual activity
• Be careful with calls, texts or emails that mention Olympia Orthopaedic or the attack
• Keep any notice letter the practice sends

Do You Have Legal Options?

Health care providers that collect patient information have a legal duty to protect it. They also have a duty to tell patients when it is exposed. When those duties are not met, affected patients and employees may have legal rights and remedies.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

FAQ

Was Olympia Orthopaedic Associates hacked?

A ransomware group called Brain Cipher listed the practice on its leak site on October 21, 2026, and has posted data it says came from the practice. As of October 27, 2026, the practice has not announced the incident.

How many people were affected?

No one knows yet. The practice has not released a number. The group claims about 146,000 files, but that is a file count, not a count of patients.

What information may have been exposed?

The group claims it took:

• Patient medical information
• Employee HR records
• Email and other internal documents

I haven’t received a letter. Should I wait?

You do not have to wait. Washington law generally requires notice within 30 days of discovering a breach, so a letter may still come. In the meantime, you can freeze your credit, watch your insurance statements and keep an eye out for scams.

What are the risks when medical data is exposed?

Medical data can be used to get care, prescriptions or insurance payments in your name. It can also be used in scams that sound real because they mention your doctor or treatment. Unlike a card number, your health history cannot be replaced.

Someone contacted me about the Olympia Orthopaedic attack. Is it real?

Be careful. Criminals often use news of a breach to send fake emails, texts or calls. Do not click links or share information. Contact the practice directly using a phone number you already know.

Do I have a legal claim?

You may. Health care providers have a duty to protect patient data and to notify patients when it is exposed. If you are a patient or employee of Olympia Orthopaedic Associates, call Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.