Almeida Law Group is investigating a data breach at Operation PAR, Inc. If you were affected, contact Almeida Law Group.
About Operation PAR, Inc.
Operation PAR, Inc. is a private nonprofit organization founded in 1970 and headquartered in Pinellas Park, Florida. It provides substance use disorder prevention, addiction treatment, and behavioral health services — including residential and outpatient care, medication-assisted treatment, detoxification, vocational education, and recovery support — serving more than 30,000 individuals each year across multiple Florida counties and into Georgia. Because the organization provides healthcare and behavioral health services, it collects sensitive personal and health information from the individuals it serves, making a breach of its systems particularly significant.
What Happened?
Operation PAR, Inc. was listed in a HHS Office for Civil Rights breach portal report submitted on June 25th, 2026. The incident is classified as a hacking/IT incident involving a network server. According to Operation PAR’s forensic investigation, unauthorized access to the network occurred between June 6th, 2025 and June 10th, 2025, when files may have been accessed or removed. The HHS filing lists 145,714 individuals as affected. The organization’s forensic review of the affected files took approximately one year to complete, concluding on June 10th, 2026, at which point consumer notifications — including to residents of Massachusetts and New Hampshire — began. Operation PAR stated it found no evidence of fraud or misuse and offered free credit monitoring through Epiq, along with a dedicated toll-free response line (877-495-0947). According to reporting by ClassAction.org based on a sample notification letter, and a third-party summary citing the official notification, the data potentially involved includes names, Social Security numbers, medical records, driver’s license information, health insurance details, addresses, and dates of birth, though the specific information affected may vary by individual. The breach notification also referenced affiliated entities Boley Centers and PEMHS (doing business as Eleos), suggesting shared network infrastructure was involved.
The WorldLeaks ransomware group claimed responsibility on its dark web leak site around July 2nd–3rd, 2025, alleging exfiltration of 485.2 GB of data comprising nearly 900,000 files. These are attacker-side claims from a dark web leak site and have not been confirmed by Operation PAR. This attribution has been reported by BreachSense and ClaimDepot, among other third-party sources. As of reporting in September 2025, no formal class action lawsuit had been filed, though multiple law firms — including Strauss Borrelli, Levi & Korsinsky, Dapeer Law, Siri & Glimstad, The Lyon Firm, and Bryson Harris Suciu & DeMay — were investigating potential class action claims as of July 2026.
Key Facts at a Glance
- Company or Organization: Operation PAR, Inc.
- Industry: Behavioral health / Substance use disorder treatment (nonprofit)
- Location: Pinellas Park, Florida, with locations across the Tampa Bay area and multiple Florida counties
- Incident type: Hacking/IT Incident — Network Server
- Date of breach: June 6th, 2025
- Date breach discovered: June 10th, 2025
- Date of consumer notification: June 10th, 2026 (state-level notifications began)
- Total persons affected: 145,714
- Identity theft protection offered: Free credit monitoring through Epiq
- Litigation status: Multiple law firms investigating potential class action claims as of July 2026; no formal class action filed as of September 2025 reporting
- Source: HHS Office for Civil Rights breach portal report (https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf#1468079); ClassAction.org (https://www.classaction.org/data-breach-lawsuits/operation-par-boley-centers-and-eleos-july-2026); Dapeer Law (https://www.dapeer.com/databreaches/operation-par-data-breach-investigation); ClaimDepot (https://www.claimdepot.com/data-breach/operation-par); BreachSense (https://www.breachsense.com/breaches/operation-par-data-breach/)
What Should You Do?
If you believe you may have been affected by this breach, consider enrolling in the free credit monitoring offered through Epiq by contacting Operation PAR’s dedicated line at 877-495-0947 before any enrollment deadline passes. You should also place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your financial accounts and credit reports closely for any suspicious activity. You can request free copies of your credit reports at AnnualCreditReport.com. If you suspect your information has already been misused, visit IdentityTheft.gov for step-by-step recovery guidance. Because health and medical information may have been involved, review any Explanation of Benefits statements you receive from your health insurer and consider requesting copies of your medical records to check for unfamiliar treatments or providers.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
