Notice of Data Breach

PADwalk.org, My Steps and the Great Circulation Challenge

Date of this notice: October 17, 2026

What happened

An unknown person signed in to the PADwalk.org administrator dashboard without authorization. Our records show sign-ins from the same source between June 17 and October 13, 2026. During that time they downloaded Great Circulation Challenge lists and viewed My Steps app and patient registry records. We learned of it on October 15, 2026, when the person contacted us, demanded payment and threatened to publish the information. We have not paid.

What information was involved

Depending on how you participated and what you provided, the information may include your name, contact information, city, state and postal code, registry patient ID, the name of your doctor and clinic, your Great Circulation Challenge team, participant type and step totals. For My Steps app users, it may also include walking sessions, symptoms, pain levels, six-minute walk test results and blood pressure, weight or blood glucose readings.

The pages the person viewed do not show passwords or dates of birth. We do not collect Social Security numbers, bank or card numbers, or insurance information.

What we are doing

We changed the administrator password, fixed the sign-in weakness, added a lockout after repeated failed sign-in attempts and blocked the source of the access. We have reset every participant's password, preserved records for the investigation, and have reported the incident to the FBI, which we are working with. We are also notifying the appropriate regulators in the United States, the United Kingdom and Europe.

What you can do

The main risks are that your contact information could be used for scam emails, texts or calls, and that the person could publish the information.

• If you have a My Steps app account, sign in with the new password we emailed you and change it under Settings, then Change password. If you used your old My Steps password anywhere else, change it there too. If you did not receive a new password, email mysteps@thewaytomyheart.org from the address you signed up with.
• Be cautious of emails, texts or calls claiming to be from Global PAD Association, PADwalk, My Steps or the Great Circulation Challenge. If anyone contacts you claiming to have your information or asking for money, do not respond or pay, and let us know.
• We will never ask for your password. Our emails come only from kym@thewaytomyheart.org, mysteps@thewaytomyheart.org or kym@padhelp.org. Do not click links in messages from any other address.
• Please do not send personal information by email or text.

Additional resources

You can place a free fraud alert or security freeze on your credit file by contacting the three major credit reporting agencies. A fraud alert tells creditors to take extra steps to verify your identity. A security freeze stops new credit from being opened in your name until you lift it. You can also get a free copy of your credit report at annualcreditreport.com or 1-877-322-8228.

• Equifax: P.O. Box 105069, Atlanta, GA 30348-5069, 1-888-298-0045, equifax.com
• Experian: P.O. Box 9554, Allen, TX 75013, 1-888-397-3742, experian.com
• TransUnion: P.O. Box 2000, Chester, PA 19016, 1-800-680-7289, transunion.com
• Federal Trade Commission: 600 Pennsylvania Avenue NW, Washington, DC 20580, 1-877-438-4338, identitytheft.gov

If you believe you are a victim of identity theft, you can file a police report and contact your state Attorney General.

• New York: Office of the Attorney General, The Capitol, Albany, NY 12224-0341, 1-800-771-7755, ag.ny.gov
• Maryland: Office of the Attorney General, 200 St. Paul Place, Baltimore, MD 21202, 1-888-743-0023, marylandattorneygeneral.gov
• Oregon: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301, 1-877-877-9392, doj.state.or.us
• Rhode Island: Office of the Attorney General, 150 South Main Street, Providence, RI 02903, 401-274-4400, riag.ri.gov
• District of Columbia: Office of the Attorney General, 400 6th Street NW, Washington, DC 20001, 202-727-3400, oag.dc.gov
• UK residents: Information Commissioner's Office, 0303 123 1113, ico.org.uk
• EU residents: the data protection authority in your country
• Canadian residents: Office of the Privacy Commissioner of Canada, 1-800-282-1376, priv.gc.ca

For more information

Email kym@padhelp.org or call us toll-free.

Kym McNicholas
CEO, Global PAD Association / The Way To My Heart