Greater Pittsburgh Orthopaedic Associates disclosed a 2025 breach, but was there also one in 2024?

Greater Pittsburgh Orthopaedic Associates (GPOA) disclosed a 2025 cyber incident after RansomHouse listed the organization on its leak site claiming encryption and data exfiltration; GPOA reported 35,000 affected to HHS in August 2025 and later disclosed 56,954 affected to the Maine AG in February 2026, offering credit monitoring while not confirming ransomware or extortion details. The report notes uncertainty over whether any data was leaked or sold and references an earlier, unconfirmed 2024 DonutLeaks claim against the group that does not appear in HHS’s breach listings, with GPOA and its counsel providing no public clarification.