Skip to content
Leak-site post naming Pavillon, captured by ThreatCluster

Pavillon

global secret group

Ransomware leak-site victim intelligence · EN

Data size
646 GB
Files
47,950
Views
47,950
Posted
Aug 5, 2026
Country
United States
Industry
Alcoholism Treatment, Hospitals & Clinics, Healthcare

Summary

Written by ThreatClusterfrom victim profile, leak post, screenshot

The group claims to have exfiltrated 646 GB across 47,950 files from Pavillon, a United States–based addiction-treatment provider. The leak post is listed by the group as published. The material is described as including HR and recruitment records, internal documentation and source code; the leak page identifies Pavillon's domain pavillon.org and notes the victim is a US-based entity with 100–200 employees and revenue of $8.5 million.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Headquarters
Mill Spring, North Carolina, United States
Employees
0
Domains
pavillon.org

What was taken

Pavillon offers innovative treatment for alcoholism, substance use and related disorders such as trauma, depression and anxiety with a continuum of care including residential, outpatient and extended care services on a beautiful 160-acre residential setting in the mountains of Western North Carolina. Pavillon’s 6-week non-profit programs focus on the needs of the mind, body and spirit for successful life-long recovery. After 12 months, 91% of residential patients report remaining in recovery. Pavillon’s licensed, caring staff support you to live free of addiction. Chef-Prepared meals promote optimal health and successful recovery. Staff satisfaction is 93% and 97% recommend Pavillon employment to others.

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Notes
Properties: 646 GB (47,950 Files, 7,750 Folders)

Leak-site images (7)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Line graph titled "Daily Total Cash Available," showing fluctuations in cash availability over time, with values ranging from approximately $500,000 to $4,000,000.
onion leak page382 KB
The image shows a multi-camera surveillance layout with four views: an office space with a desk and computer, a reception area, a hallway, and equipment in a utility room.
onion leak page415 KB
Screenshot of a backup catalog interface displaying a list of recovery points, applications, and modes for various data backups.
onion leak page734 KB
Document containing a report from Paradigm with sections for personal information, test results, and a note to email a team.
onion leak page340 KB
Screenshot of an Excel spreadsheet containing columns for service details, amounts, revenue, and charges related to medical or therapy services.
onion leak page245 KB
Screenshot of a VMware ESXi interface displaying a list of virtual machines with their statuses, resource usage, and details.
onion leak page326 KB