Anubis ransomware claims medical data breach at Oregon's Santiam Hospital
The Anubis ransomware group listed Santiam Hospital & Clinics, a community hospital and clinic network in Stayton, Oregon, on its leak site and called the incident a major medical data breach. No data volume, file list or verified samples have been published, the hospital has not confirmed an incident, and the claim remains unverified. Treat it as a threat-actor claim and monitor the leak site and official hospital channels.
What happened
The Anubis ransomware group listed Santiam Hospital & Clinics, a community hospital with clinics in Stayton, Oregon, on its leak site. The group called the incident a major medical data breach. The hospital has not confirmed the incident and no data has been released as proof.
Why it matters
If confirmed, an attack could expose patient records plus clinical and billing data and trigger HIPAA breach-notification obligations, according to the analyst note. The target is a community hospital serving the local population. A listing alone does not prove a breach.
What to do
Treat the claim as unverified until confirmed. Monitor the group's leak site and the hospital's official channels for samples or data publication. Check internal logs and alerts for signs of compromise.
For the technical team
- Affected
- Santiam Hospital & Clinics Rede de TI do Santiam Hospital & Clinics, hospital comunitário com rede de clínicas em Stayton, Oregon (EUA); alegado va · Santiam Hospital & Clinics: community hospital with a clinic network in Stayton, Oregon (USA), named as the target in the listing. Affected systems and versions have not been disclosed.
- Exploitation
- No confirmed exploitation. The listing on the Anubis group's leak site was reported by DailyDarkWeb, with no verified samples, file list or data volume published.
- Fix
- No software to update
- More details
- The Anubis group runs a ransomware-as-a-service extortion operation and has repeatedly targeted healthcare, according to DailyDarkWeb. A real hospital compromise could expose patient records plus clinical and billing data and trigger HIPAA breach-notification obligations. A leak-site listing alone does not prove a breach.
Timeline
Anubis group listed the hospital on its leak site; claim still unverified.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
