World Leaks Claims Data Theft from State Agency Contractor

Cybercriminal gang World Leaks – formerly Hunters International – claims to have stolen 52.4 gigabytes of data containing 42,204 files from Massachusetts-based Freedman HealthCare, a contractor that provides data integration and analytics services to state health agencies.

See Also: How Linking Identity, Data Security Can Help Cyber Response

World Leaks reportedly threatened on Monday to begin leaking on Tuesday data allegedly stolen from FHC, media outlet The Register said. By Wednesday, World Leaks appeared to have leaked on its dark website some information, including management and user accounts and passwords and state contracts, but no protected health information, so far, The Register said.

Late on Tuesday, FHC CEO John Freedman issued a statement to the media outlet denying that any health data had been compromised, The Register said.

On Wednesday morning, Freedman confirmed to Information Security Media Group the statement, stressing in particular that no PHI was among the data compromised in the incident.

He declined comment to ISMG on World Leaks’ specific claims.

“In late April we discovered a security incident that compromised a limited portion of our IT system,” Freedman said in the statement.

Upon discovering the incident, FHC immediately engaged external cybersecurity experts to secure the company’s network and conduct a forensic investigation, the statement said.

“The investigation determined that the incident only impacted one file server and did not affect any protected health information of any of our clients. No all-payer claims data was affected. We located and removed all malicious files and re-secured our system. Again, no health data was compromised in this incident.”

FHC on its website said it works with health-related agencies and projects in a number of states, including Hawaii, Rhode Island, California, Massachusetts and Delaware.

In addition to state agencies, FHC says on its website that its other clients include health insurers and other payers, as well as pharmaceutical and medical device companies.

Breach Reporting

The dark web claims that cybercriminals have accessed FHC account information and passwords is concerning, said regulatory attorney Paul Hales of the Hales Law Group.

“Those credentials could allow access to client information systems,” he said. “Sophisticated cybercriminals like World Leaks prize credential theft. It enables them to log into secure databases as legitimate users and quickly exfiltrate data, leaving minimal evidence,” he said.

IBM in its 2025 X-Force Threat Intelligence report released in April found that nearly one in three cyber incidents observed in 2024 resulted in credential theft, as attackers focus on multiple pathways to quickly access, exfiltrate and monetize login information.

“It will soon become apparent if World Leaks used FHC credentials to steal protected health information and other personally identifiable information,” Hales said.

If FHC’s forensic investigation conclusively determined that no PHI was accessed or disclosed, FHC would not be required to report the incident to HHS OCR as a HIPAA breach, said attorney Andrew Mahler, vice president of compliance and privacy at consulting firm Clearwater.

“However, if there’s any uncertainty about whether PHI was accessed – for example, if the compromised server could have contained PHI or if the investigation is incomplete – FHC must conduct a risk assessment to determine the likelihood of a breach,” he said.

State data breach notification laws vary but typically require notification to affected individuals, the state, and others, if PII such as names, Social Security numbers, or financial data is compromised, he said.

“If the compromised server contained PII or if state contracts included sensitive data triggering state-specific laws, notification might be required,” he said. “In addition, some state laws mandate notification if there’s a risk of harm from unauthorized access to personal information.”

Meanwhile, World Leaks, like other extortion groups, has shifted to an “extortion-as-a-service” model, focusing on data theft over encryption, Mahler said.

“This aligns with broader trends in healthcare cyberattacks, where groups exploit sensitive data for extortion,” he said.

“Organizations that work with PII and other types of sensitive data, particularly health and financial data, should prioritize incident response exercises, as well as controls like robust encryption, network segmentation, multi-factor authentication, and employee training to mitigate these risks.”