A ransomware group says it hacked Guardian Pharmacy, a pharmacy that serves about 207,000 residents of assisted living, memory care and nursing communities. Guardian has not confirmed the claim.
Guardian Pharmacy Services, Inc. is based in Atlanta, Georgia, and trades on the New York Stock Exchange. It runs 61 local pharmacies that fill and manage medications for long-term care communities in 38 states, according to the company’s website.
Around October 1, 2026, the ransomware group INC Ransom listed “Guardian Pharmacy LLC” on its leak site, according to public ransomware tracking sites. A leak site is a website where a criminal group names organizations it says it attacked, often to pressure them into paying. The group also claims to have posted sample files. The address on the group’s post matches Guardian Pharmacy Services’ Atlanta headquarters.
INC Ransom is a ransomware group. Ransomware is malicious software that locks or copies an organization’s files so criminals can demand payment. Groups like this often threaten to publish files if a victim does not pay.
These are claims by a criminal group. Guardian has not confirmed them. As of October 20, 2026, Guardian had not issued a public statement, mailed notice letters, filed a breach report with a state attorney general or the U.S. Department of Health and Human Services, or reported a cybersecurity incident to the SEC. Its most recent SEC reports, filed in May and August 2026, do not mention a cyber incident.
Guardian serves people who may be especially vulnerable to fraud. Its customers include older adults in assisted living and memory care, hospice patients and people with intellectual and developmental disabilities.
No data types have been confirmed in this incident. In general, a long-term care pharmacy may hold records such as resident names, dates of birth, medication lists, prescriber details and Medicare or insurance information. A company like this also keeps employee records. Guardian has not said whether any of these records were involved.
No. Guardian has not announced credit monitoring or any other help because it has not confirmed a breach. If Guardian later sends notice letters, those letters should explain any offer.
A proposed class action was filed against Guardian Pharmacy Services in federal court in Atlanta on October 14, 2026, about two weeks after the claimed listing. A filed lawsuit is not proof that data was taken or that any claim will succeed.
Until Guardian says more, people connected to the company can take simple steps:
Pharmacies that collect health and personal information have a legal obligation to safeguard it and to give notice when that protection fails. If Guardian confirms that personal information was involved, affected residents, family members and employees may have legal rights and remedies.
Has Guardian Pharmacy confirmed a data breach?
No. As of October 20, 2026, Guardian has not confirmed a data breach or said that any information was taken. The only public claim comes from INC Ransom, a criminal group. This page will be updated if Guardian releases a notice.
How many people were affected?
No number has been released. Guardian serves about 207,000 residents, but that is the size of its business, not a count of people affected.
What information was involved?
None has been confirmed. Guardian has not said what, if any, records were involved.
Has a lawsuit been filed?
Yes. A proposed class action was filed against Guardian Pharmacy Services in federal court in Atlanta on October 14, 2026, and it may be related to this incident. A filed case does not mean anyone has proven a claim.
My parent lives in a community Guardian serves. What should I do?
Why do criminals want pharmacy and medical records?
Medical records can be used for medical identity theft. That is when someone uses your name or insurance to get care, drugs or equipment. It can leave false entries in your health file and bills in your name. It is often harder to spot than credit card fraud.
Could scammers contact me about this incident?
Yes. After a claimed attack becomes public, scammers sometimes pose as the company, a bank or Medicare. Do not give out personal details on an unexpected call. Call back using a number you know is real.
Do I have a legal claim?
Organizations that hold health and personal records have a duty to protect them and to tell people promptly when that protection fails. If you worked for, bought from, or were a customer or patient of Guardian Pharmacy, you may have rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
