Rhysida Hacking Group Strikes More Healthcare Providers

A Kansas-based medical practice and a Rhode lsland-based provider of mental health and addiction counseling and related services are the latest victims in a growing list of healthcare organizations reporting major data breaches by Russian-speaking cybercriminal gang Rhysida.

See Also: Top 10 Technical Predictions for 2025

Sunflower Medical Group, which operates four clinics in the Kansas City region offering urgent care, pediatric care and a range of other services, told Maine’s attorney general on Friday that a hacking incident affected nearly 221,000 individuals.

That same day, Community Care Alliance, which offers programs for individuals dealing with mental illness, addiction, housing issues and trauma-related issues in Rhode Island, also reported to Maine regulators a hacking incident affecting nearly 115,000 people (see: Rhysida Claims Major Data Theft From 2 More Health Systems).

Ransomware gang Rhysida lists sensitive information allegedly stolen in these hacks for sale in its dark web leak site. That includes a 3 terabyte SQL database allegedly belonging to Sunflower Medical Group containing more than 400,000 driver’s licenses, insurance cards and Social Security numbers, and also a 2.5 terabyte Community Care Alliance SQL database containing personal customer data, addresses, Social Security numbers, phone numbers and credit cards.

Those are just two of about 169 victims that Rhysida listed as of Monday on its dark web leak site, including several other healthcare sector entities, such as other mental health and addiction clinics, specialty medical groups such as orthopedic and dental practices, and a nursing home.

Pediatric hospital Ann & Robert H. Lurie Children’s Hospital of Chicago, which was disrupted by a ransomware attack in February 2024, is listed among its healthcare sector victims as having “all data sold” is (see: Rhysida Offers to Sell Children’s Hospital Data for $3.4M).

That same month, Rhysida listed the data from the 312-bed pediatric research hospital for sale for 60 bitcoin – or about $3.4 million. It is unclear how much Rhysida received from the actual sale of the children’s hospital’s data.

But besides healthcare sector organizations, Rhysida’s listed victims also include several schools, local government agencies, law firms and a hodgepodge of other businesses including tech services vendors, maintenance companies, garden nurseries and many other organizations.

Rhysida, which first surfaced around May 2023, has been the subject of at least two advisories from the U.S. Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center – one in August 2023 and another in January 2024. Security researchers believe the group is located in Russia or in the neighboring Commonwealth of Independent States (see: Authorities Warn Health Sector of Attacks by Rhysida Group).

Rhysida was also the subject of a joint warning in November 2023 from the Cybersecurity and Infrastructure Security Agency, the FBI and the Multi-State Information Sharing and Analysis Center.

“Rhysida, like many ransomware groups, focus on organizations that are both vulnerable and more likely to pay a ransom due to the criticality of their services and the sensitivity of the data involved,” said Jason Baker, managing security consultant of GuidePoint Security.

“Healthcare providers often operate with limited security resources despite possessing high volumes of sensitive patient information. This combination of suboptimal defenses and high-value data makes for attractive targets,” he said. Similarly – other Rhysida victims – including schools and educational institutions – typically have underfunded IT departments, outdated systems and distributed infrastructure that can be difficult to secure, he said.

“Sensitive information, particularly as it pertains to minors or relevant to sensitive topics, could be perceived as increasing coercive leverage by Rhysida and similar groups.”

As for the Sunflower Medical Group hack, the healthcare provider said in a breach notice posted on its website that it became aware of suspicious activity within its computer network on Jan. 7.

Sunflower’s investigation found that an unknown third party accessed the practice’s systems on or about Dec. 15, 2024, and, during that time, acquired copies of files from Sunflower’s systems.

The type of information affected by the incident varied by individual but may have included one or more of the following: name, address, date of birth, Social Security number, driver’s license number, medical information, and health insurance information, Sunflower said.

Sunflower’s breach notice does not mention Rhysida, and the medical practice did not immediately respond to Information Security Media Group’s request for comment on Rhysida’s claims.

Community Care Alliance, in its breach notice, said its investigation into its hacking incident determined that certain information may have been accessed or acquired from its network by “an unauthorized individual” between July 1 and July 5, 2024.

The investigation, which was completed Jan. 8, found that the types of information potentially affected in the incident include individuals’ name, address, date of birth, driver’s license number, Social Security number, diagnosis and medical condition, lab results, medications, patient ID number, health insurance information, provider name and other treatment information.

Community Care Alliance said it contacted law enforcement about the incident and has implemented additional security measures to minimize the risk of a similar future incidents.

Community Care Alliance did not immediately respond to ISMG’s request for comment on Rhysida’s claims.

Of course, Rhysida attacks are not the only hacks resulting in recent major health data breaches. Gastroenterology Associates of Central Florida, which does business as Center for Digestive Health, on Thursday reported to Maine regulators that more than 122,400 individuals were affected by an April 2024 hacking incident.

Ransomware group BianLian lists the Center for Digestive Health on its leak site claiming to have 2.2 terabytes of the practice’s data, including patients’ physical and medical history examination records, as well as accounting, budget and financial data.

The Center for Digestive Health did not immediately respond to ISMG’s request for comment on BianLian’s claims.