Step By Step listed on Storm ransomware leak site

• Ransomware group: Storm
• Country: United States
• Sector: Education
• Announcement date: October 3, 2026

Storm group claims a data breach against Step By Step

The ransomware group known as Storm has listed the United States-based organization Step By Step on its dedicated leak site. Through this announcement, the group is alleging that it has successfully carried out a data breach against the nonprofit entity. This type of activity is a common tactic used by modern ransomware actors, often involving a strategy known as double extortion. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to use as leverage, threatening to publish the data on public leak sites if a ransom is not paid.

According to the information provided by the threat actor, the incident occurred recently. The Storm group added Step By Step to its leak portal on October 2, 2026, following their claimed attack date of October 2, 2026. While the group has officially announced the victim on their platform, the specific details regarding the scope of the breach remain limited at this stage of the disclosure.

Details of the claim and evidence provided

As of the current reporting, the Storm group has not provided a comprehensive file list to substantiate the full extent of the alleged theft. While the group claims to have compromised the organization's data, they have not yet uploaded a directory or a specific list of files that have been exfiltrated. However, the group has provided 16 images as proof to support their claim of having access to the organization's environment.

Regarding the specific content of the breach, the listing names no data types. There is currently no clear information regarding the nature of the compromised data, as no specific file list has been provided by the group to clarify what was taken during the operation.

About Step By Step

Step By Step is a nonprofit organization that has been established since 1977. The organization is based in Pennsylvania and provides community-based support services to a variety of individuals. Their mission focuses on supporting people with intellectual and physical disabilities, autism, and mental health disorders. To achieve this, the organization offers a range of individualized services, including residential programs, vocational support, and behavioral health counseling.

Potential risks and organizational implications

This incident may pose a significant risk to the privacy of individuals, given the sensitive human services and health support provided by the organization. Because the organization serves vulnerable populations, any exposure of information could lead to secondary risks for the individuals being served, such as identity theft or targeted phishing attacks.

Furthermore, as the institution operates within the United States, a potential data breach could lead to legal consequences under existing regulations, such as HIPAA, which governs the protection of health information. Organizations operating in this sector must be aware that the exposure of sensitive data can result in long-term regulatory scrutiny and loss of trust from the community they serve.

While information about the Storm group remains limited—with their specific methods and motivations remaining uncertain—this event highlights the ongoing threat to nonprofit organizations. To defend against such threats, organizations in this sector often implement defensive steps such as robust encryption, multi-factor authentication, and regular security awareness training to mitigate the risk of unauthorized access and data exfiltration.