Step By Step Listed by Storm Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group calling itself Storm has listed Step By Step, a Pennsylvania human-services nonprofit, on its leak site. The listing is an unverified claim by the group. As of writing, Step By Step has not publicly confirmed that an incident occurred, that systems were accessed, or that any data left its control. Public detail is limited: the number of people who might be affected is unknown, and the listing does not name specific data types.

For clients, families, staff, and partners, the practical stakes are real even while the claim remains unproven. Organizations in this field often hold sensitive personal, health-related, and support-plan information. If any of that material were ever taken and published or traded, the harm could include privacy loss, targeted fraud, or distress for people who already rely on careful handling of their records. This article separates what the listing actually says from what it does not establish, and outlines conditional steps people can take.

Inside the listing

According to the available record, Storm listed Step By Step on its leak site, with the report dated October 02, 2026. The organization is described in the summary as Step By Step, Inc., a private nonprofit human services organization based in Wilkes-Barre, Pennsylvania. The listing frames the entity in a consulting and human-services context. Beyond that framing, the public record provided here does not describe how any alleged intrusion would have occurred, whether ransomware was deployed on live systems, what volume of data is supposedly involved, or a deadline for payment or publication.

People affected are recorded as unknown. Data types named as exposed are not disclosed. No file counts, sample screenshots, or internal document titles appear in the facts supplied for this write-up. In plain terms, the leak-site entry is a claim that the group has associated the organization’s name with its extortion channel. It is not independent confirmation from the organization, a regulator, or a breach-notification index. Readers should treat scale, method, and contents as undisclosed unless and until a primary source other than the crew’s marketing page says otherwise.

Inside Storm

Storm is known in public reporting as a ransomware and data-extortion actor that pressures organizations by threatening to publish material it says it obtained. Like other groups in this category, it typically advertises victims on a dedicated leak site, sometimes with countdowns or purported file samples, to increase leverage. Public coverage of such crews generally describes double-extortion patterns: encryption of systems paired with a threat to leak data, or leak-only pressure when encryption is secondary. Exact toolsets and affiliates can change over time, and those operational details are not specified in the listing facts for this case.

For this incident, the only victim-specific assertion in the given facts is that Storm has listed Step By Step. Any implication that particular folders, databases, or client files were copied is the group’s claim, not a verified inventory. Leak-site posts are written to create urgency; they are not audited disclosures. Nothing in the supplied record confirms that Storm’s claim about this organization is accurate, complete, or new rather than recycled or inflated.

Step By Step and its sector

Step By Step, Inc. is publicly described as a private nonprofit established in 1977 and headquartered in Wilkes-Barre, Pennsylvania. It provides community-based support to people with intellectual and physical disabilities, autism, mental health disorders, and substance use disorders. Services commonly associated with such an organization include residential programs, vocational and employment support, behavioral health and counseling, autism services, in-home and community support, and other individualized programs aimed at independence and daily living.

Human-services and disability-support nonprofits sit at a sensitive intersection of care delivery and record-keeping. They coordinate with families, clinicians, employers, and public programs. A leak-site listing that names such an organization matters because the sector’s work depends on trust and on information that can be highly personal. That consequence follows from the nature of the work and from the claim itself; it does not require treating the crew’s post as proven fact. What a listing establishes is that a named extortion group has chosen to publicize the organization’s name. What it does not establish is unauthorized access, the success of any attack, or negligence on the part of the nonprofit.

What data was at risk

The facts state that data types named as exposed are not disclosed. It is therefore not possible to say from this record which systems, if any, were touched or which categories of information, if any, were copied. Asserting a concrete inventory would go beyond the evidence.

If files were taken from an organization of this kind, firms and nonprofits in human services typically hold some mix of identity and contact details, program enrollment and service plans, health and behavioral information relevant to care, housing or residential notes, employment and vocational records, billing or funding-related documents, and staff or contractor information. Those are sector norms, not a confirmed description of this listing. Because the crew has not, in the supplied facts, itemized contents, any discussion of risk must stay conditional: if sensitive records were involved, those are the categories people in this sector usually worry about; the exact contents here remain unconfirmed.

The real-world impact

For individuals and families, the conditional risks are practical. If personal or clinical support information were ever exposed, possible outcomes include unwanted contact, social stigma, attempts at impersonation against benefits or service providers, and phishing that references real program details to seem legitimate. People with disabilities or mental-health and substance-use support needs can face heightened harm from privacy loss because the information is tightly tied to daily care and independence. Staff could face similar identity and employment-related fraud risks if workforce data were included—again, only if such data were actually taken.

For the organization, an unverified leak-site listing still creates operational and reputational pressure: need to investigate, communicate carefully with stakeholders, and work with counsel and, where appropriate, regulators or insurers. Clients and partners may ask for clarity the public record does not yet provide. None of that proves the claim; it describes what listings are designed to trigger. The absence of confirmed counts and data types also means the public cannot yet gauge breadth. Unknown affected-person counts and undisclosed data types leave a wide range of possibilities, from a hollow threat to a serious event—neither end of that range should be assumed from the listing alone.

If your data was involved

Step By Step has not publicly confirmed this incident as of writing. If you receive services from the organization, work there, or are a family member or guardian, treat the following as precautions in case your information was ever involved—not as a statement that it was.

• Be wary of unexpected calls, texts, or emails that reference your programs, diagnoses, housing, or benefits; verify through official numbers or portals you already trust, not through links or callbacks the message provides.
• Watch financial, benefits, and medical-portal accounts for new claims, address changes, or password resets you did not start.
• If you used a reused password on any related account, change it and turn on multi-factor authentication where available.
• Keep copies of any suspicious messages and report confirmed fraud to your bank, relevant agencies, and local authorities as appropriate.
• You can run a free exposure scan of your email to check whether your address has already appeared in other known breach datasets, which is a separate check from this unverified listing.

Official confirmation, notices to affected individuals, or regulatory filings—if they come—would be the place to learn whether your records were implicated and what specific protections the organization recommends. Until then, the responsible stance is caution without panic: the Storm listing is a claim, public detail on scope and contents is limited, and conditional hygiene remains the useful response for ordinary people who may be connected to Step By Step.

AICompiled with AI assistance from public sources and published under our editorial standards.