MedStar Health Notifying Patients of Data Theft Breach

MedStar Health, which operates 10 hospitals and 300 other care sites in Maryland, Virginia and Wash. D.C., is notifying a yet-undisclosed number of patients of a data theft incident affecting their sensitive information. Ransomware group Rhysida claims on its darkweb leak site to have 3.7 terabytes of MedStar’s stolen data, including “over 7 million pieces of patients’ personal data.”

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

MedStar in a breach notice posted on its website said it began on Dec. 3 to notify affected individuals by mail.

“On Oct. 4, we learned about a cybersecurity incident in which an outside party gained unauthorized access to MedStar Health’s systems that included patient information,” the notice said.

MedStar said it took immediate steps to secure its systems, launched an investigation with the assistance of third-party forensic experts, and notified law enforcement.

“Our investigation determined that the unauthorized access to MedStar Health’s systems occurred from Sept. 12 to Sept. 16.”

Compromised files contained patient information including names, dates of birth, Social Security numbers and potentially information related to patient care, such as diagnoses, medications, test results, images, health insurance and treatment information, MedStar said.

MedStar Health is offering complimentary identity monitoring services to patients whose Social Security numbers or driver’s license numbers were potentially compromised in the incident.

Legal Woes

So far, MedStar is facing consolidated proposed federal class action litigation involving the cyber incident.

That amended lawsuit complaint, filed on Dec. 15, alleges that on or about Oct. 4, “notorious” international ransomware gang Rhysida publicly claimed credit for accessing and exfiltrating 7 million pieces of patient data from MedStar.

The gang “posted a seven-day countdown timer and indicated that the data was available for the price of 25 bitcoin,” the lawsuit alleges.

As of Thursday, Rhysida on its darkweb leak site still claims to have MedStar’s data, including “SQL databases, diagnoses, pharmaceuticals and much more!”

All files were uploaded to public access, “data hunters, enjoy,” Rhysida said on its leak site posting about MedStar.

The consolidated lawsuit, which seeks financial damages and injunctive relief “to ensure the implementation of proper security measures to protect the private information that remains in defendant’s possession,” alleges – among other claims – that MedStar was negligent in failing to protect class members’ and plaintiffs’ data.

“As a direct and proximate result of the data breach, plaintiffs and class members have suffered actual and present injuries,” including the continuing threats of identity theft crimes, fraud, scams and other misuses of their private Information, the complaint alleges.

MedStar did not immediately respond to Information Security Media Group’s request for comment on the proposed class action litigation, Rhysida’s claims and for additional details about the breach, including the number of people affected.

Other Hacks

The 2025 cyberattack on MedStar Health is not the organization’s first ransomware encounter. A March 2016 ransomware attack involving MedStar Health to shut down many of its systems for about a week to avoid the spread of the malware (see: MedStar Shuts Systems After Cyberattack).

MedStar is among at least 240 alleged victims listed on Rhysida’s darkweb leak site as of Thursday. Many of those alleged victims are other healthcare related entities.

That includes Kansas-based Sunflower Medical Group, which recently agreed to pay $1.2 million to settle proposed class action litigation involving an alleged Rhysida attack that compromised the sensitive data of nearly 256,000 individuals (see: Medical Group Will Pay $1.2M to Settle Data Theft Lawsuit).

Also, Bayhealth Medical Center in Delaware recently agreed to pay $2.5 million to settle proposed class action litigation involving an alleged Rhysida attack in 2024 that affected more than 497,000 people (see: Delaware Health System Plans to Settle Rhysida Hack Lawsuit).

Since surfacing in 2023, ransomware-as-a-service gang Rhysida has been the subject of several alerts by U.S. federal agencies warning healthcare and other sectors – including education, government, IT and manufacturing – of the gang’s attacks (see: Authorities Warn Health Sector of Attacks by Rhysida Group).