Leak-site post naming Pavillon, captured by ThreatCluster

Pavillon

global secret group

Ransomware leak-site victim intelligence · EN

Data size
646 GB
Files
47,950
Views
47,950
Posted
Aug 5, 2026
Country
United States
Industry
Alcoholism Treatment, Hospitals & Clinics, Healthcare

Summary

Written by ThreatCluster from victim profile, leak post, screenshot

The group claims to have exfiltrated 646 GB across 47,950 files from Pavillon, a United States–based addiction-treatment provider. The leak post is listed by the group as published. The material is described as including HR and recruitment records, internal documentation and source code; the leak page identifies Pavillon's domain pavillon.org and notes the victim is a US-based entity with 100–200 employees and revenue of $8.5 million.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Headquarters
Mill Spring, North Carolina, United States
Employees
0
Domains
pavillon.org

What was taken

Pavillon offers innovative treatment for alcoholism, substance use and related disorders such as trauma, depression and anxiety with a continuum of care including residential, outpatient and extended care services on a beautiful 160-acre residential setting in the mountains of Western North Carolina. Pavillon’s 6-week non-profit programs focus on the needs of the mind, body and spirit for successful life-long recovery. After 12 months, 91% of residential patients report remaining in recovery. Pavillon’s licensed, caring staff support you to live free of addiction. Chef-Prepared meals promote optimal health and successful recovery. Staff satisfaction is 93% and 97% recommend Pavillon employment to others.

Leak-site images (7)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Line graph titled "Daily Total Cash Available," showing fluctuations in cash availability over time, with values ranging from approximately $500,000 to $4,000,000.
onion leak page 382 KB
The image shows a multi-camera surveillance layout with four views: an office space with a desk and computer, a reception area, a hallway, and equipment in a utility room.
onion leak page 415 KB
Screenshot of a backup catalog interface displaying a list of recovery points, applications, and modes for various data backups.
onion leak page 734 KB
Document containing a report from Paradigm with sections for personal information, test results, and a note to email a team.
onion leak page 340 KB
Screenshot of an Excel spreadsheet containing columns for service details, amounts, revenue, and charges related to medical or therapy services.
onion leak page 245 KB
Screenshot of a VMware ESXi interface displaying a list of virtual machines with their statuses, resource usage, and details.
onion leak page 326 KB