ViaQuest Data Breach 2026 Investigation

A ransomware attack targeting ViaQuest, Inc., a Dublin, Ohio-based healthcare and disability services organization, has raised concerns for tens of thousands of people whose personal and medical information may have been compromised. If you received a notice from ViaQuest, or if you believe your data was exposed, you may have legal options worth exploring. Contact our data breach lawyers to discuss further.

What Is ViaQuest?

Founded in 1999, ViaQuest provides a broad range of healthcare and support services across Ohio, Indiana, and Pennsylvania. The company serves individuals with developmental disabilities and other complex medical conditions. Its operations span more than 50 locations and employ thousands of staff members across multiple states.

Because of the sensitive nature of the population ViaQuest serves, the type of data the company collects and maintains is particularly personal. This includes mental health records, treatment histories, disability diagnoses, and other protected health information covered by the Health Insurance Portability and Accountability Act (HIPAA).

What Happened in the ViaQuest Data Breach?

According to cybersecurity monitoring firm BlackFog, a ransomware group claimed responsibility for an intrusion into ViaQuest's systems in early 2026. The group alleged that approximately 4.1 terabytes of data, representing over one million files, was taken during the incident. Based on the group's claims, the breach potentially affected more than 37,500 patients and approximately 3,900 employees. The reported categories of exposed data include:

• Personal identifying information
• Medical and clinical records
• Employee records and personnel data
• Internal administrative documents

As of the time of publication, ViaQuest had not issued a public statement confirming or addressing the ransomware group's claims. The full scope of the incident had not been independently verified. However, given the sensitivity of the data ViaQuest handles and the scale of what the threat actors allege, affected individuals have good reason to pay close attention to any breach notification letters they receive.

Ohio Data Breach Notification Law

Under Ohio's data breach notification statute, companies that experience a security incident involving personal information must notify affected residents in a timely manner. Ohio law generally requires notification to occur as quickly as possible, but no later than 45 days following discovery of the breach. Written, telephone, or electronic notice may be used depending on how the company typically communicates with those affected.

If ViaQuest confirms that protected health information was accessed, it would also be subject to the HIPAA Breach Notification Rule, which requires covered entities to notify affected individuals, the U.S. Department of Health and Human Services, and in certain cases the media, within 60 days of discovering the breach.

Why Hire The Lyon Firm?

The Lyon Firm is a nationally recognized class action and data privacy law firm based in Cincinnati, Ohio. Attorney Joe Lyon has represented thousands of clients across all 50 states and has been appointed lead class counsel in both state and federal consumer class actions. The firm has secured millions of dollars in settlements for victims of healthcare data breaches, including a $7 million settlement in the Christ Hospital pixel case and an $8.2 million settlement in the Reventics case.

When large healthcare organizations fail to protect the people who depend on them most, The Lyon Firm holds them accountable. If you believe your information was compromised in the ViaQuest data breach, contact The Lyon Firm today for a free and confidential consultation. There are no fees or costs unless a recovery is achieved.