A New Data Theft Gang for the Health Sector to Lose Sleep Over

A new cybercriminal gang appears to be targeting the healthcare industry, a sector with a reputation for paying extortionists rather than risk harm to patients.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Since first surfacing on the darkweb in recent weeks, the Insomnia data theft group has chalked up 18 alleged victims on its data leak site. More than half have ties to healthcare.

Among the victims listed on Insomnia’s data leak site as of Wednesday, most are healthcare providers, or companies that are involved with work concerning healthcare issues, including two law firms that handle medical malpractice cases and one manufacturer of surgical and medical gear.

Overall, all of the victims – except for two in Brazil and Singapore – are based in the United States. Most of the alleged victims with healthcare industry ties have revenue ranging between $5 million and $57 million, and between 11 and 200 employees.

None of Insomnia’s alleged health-related victims immediately responded to Information Security Media Group’s requests for comment on the cybercrime gang’s data leak claims.

The healthcare sector has long enjoyed a reputation as an easy touch among cyber extortionists, who discovered the industry often badly guards sensitive data and has been willing to treat with cybercriminals lest a cybersecurity incident spiral into real-world harms.

The emergence of Insomnia notwithstanding, that may be changing. An annual survey of healthcare providers by cybersecurity firm Sophos published last October found 36% of victims paid a ransom demand – a figure much diminished from a rate of 61% that Sophos reported in 2022.

The survey also found a sharp decline in the average ransom payout, down to $150,000 in 2025 from $1.47 million in 2024. “The findings point to a sector becoming a tougher environment for cybercriminals, with both demands and payments now skewing toward smaller, lower-value cases,” Sophos concluded.

Insomnia’s first entry onto its data leak site is dated Oct. 8, 2025, which may suggest the operation has been active since at least then, said Lin Levi, threat intelligence analyst team lead at security firm Kela.

“According to Kela’s database, none of these victims were previously claimed by ransomware groups or posted on other known leak sites,” he said. Samples seen by ISMG on Insomnia’s data leak site include a variety of documents and correspondence that contain patient information, drivers’ licenses, tax forms and a range of other sensitive personal and health related information.

“All allegedly stolen data is currently available for free download and appears to include documents as recent as January 2026. Kela has not independently verified the authenticity of the data,” Lin said.

Christiaan Beek, senior director of threat intel and analytics at security firm Rapid7, said that what stands out most so far to him about Insomnia is that the group appears “optimized for stealthy data theft versus loud, disruptive ransomware attacks.”

“The group leverages credential-based access, including infostealer-sourced credentials and authentication bypass vulnerabilities and abuses legitimate infrastructure like [Windows Server updates] to move laterally inside networks,” he said.

“Insomnia’s operational model suggests a focus on speed, low visibility and maximizing extortion leverage through sensitive data exposure rather than system encryption,” Beek said.

There are also indicators that Insomnia may function as a broker or platform for monetizing stolen data, potentially collaborating with or sourcing access from other criminal actors. “This suggests a hybrid model where Insomnia either conducts intrusions directly or facilitates monetization for other access brokers.”

At this stage, Kela has not identified a negotiation portal or ransomware variant linked to Insomnia, Lin said. “Based on current evidence, we are monitoring the operation primarily as a data leak site rather than a ransomware encryption operation,” he said.

Beek said Insomnia appears to avoid targeting most countries formerly part of the Soviet Union, a pattern historically associated with Russian-speaking cybercrime actors operating under informal “safe harbor” norms.

Other ransomware and extortion groups remain highly active in the healthcare sector, including emerging rebrands and established operators that continue to target hospitals and related services, Beek said. “Groups like Qilin and newer entities such as Sinobi have demonstrated continued interest in healthcare organizations, particularly those with limited security maturity,” he said.

Kela has counted 68 healthcare groups targeted by cybercrime groups so far this year. Fifty of them were based in the United States, continuing a trend of strong U.S. targeting, Lin said.

“This targeting pattern is consistent with ransomware/extortion operations being opportunistic and financially motivated,” he said. The large number of healthcare organizations in the U.S. contributes to its prominence as a target.