Avalon Hills Listed by sinobi Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 18, 2026, the sinobi ransomware group listed Avalon Hills on its leak site. The number of people whose information may have been involved is not known. Avalon Hills supports recovery programs for eating disorders. Its administrative operations include financial assistance and insurance coordination for clients and families. The listing indicates that internal files were taken during a ransomware attack, which raises questions about the handling of records tied to those services.

What happened

The sinobi group listed Avalon Hills and stated that internal files had been exfiltrated in a ransomware attack. No information has been released about when the attack occurred, how the files were obtained, or the volume of data involved. The scale of any impact on individuals remains undisclosed.

The group behind it: sinobi

Sinobi is a ransomware operator that targets organizations and lists claimed victims on a public leak site. The group typically encrypts systems and threatens to publish stolen files if ransom demands are not met. In this case the group claims to hold files from Avalon Hills, but no independent verification of the contents or the circumstances of the theft has been provided.

Who is Avalon Hills?

Avalon Hills runs a program that assists people recovering from eating disorders. Business staff manage day-to-day operations such as call routing, travel arrangements, financial tracking, and technical support. A dedicated financial and utilization-review team works with families to access insurance benefits and expand resources available for treatment.

What was likely exposed

The only detail released is that internal files were allegedly exfiltrated. The exact categories of information contained in those files have not been disclosed. Entities that coordinate insurance and financial support for health programs commonly hold records on billing, coverage details, client contact information, and internal operational documents, though it is not confirmed whether any of these were present.

Why it matters

Files that document financial arrangements or insurance interactions can contain personal identifiers and sensitive program-related details. Unauthorized access to such material may increase the chance of identity misuse or unwanted disclosure of participation in treatment services. For the organization, the incident adds the task of assessing what was taken and addressing any resulting operational or legal obligations.

Were you affected?

Anyone who has received services or financial assistance through Avalon Hills should contact the organization for direct information about the incident. Routine monitoring of insurance statements, bank accounts, and credit reports can help detect unusual activity. Running a free exposure scan with an email address can show whether the address appears in previously published breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.