The Gentlemen extortion gang has added a Florida cardiovascular provider to its growing string of healthcare victims. First Coast Heart Vascular Center, which offers cardiology, electrophysiology, advanced imaging, and vascular surgery across Northeast Florida, was listed on the group’s leak site on August 14 with an estimated attack date the same day.
The listing does not state how much data was taken. The claim is unconfirmed, and the center has not publicly acknowledged the incident.
The Gentlemen has been among the most active ransomware operations targeting healthcare in recent months. It claimed data theft at Taiwan biopharma firm PharmaEssentia and nursing home operator Eva Care in August, listed AnMed on its leak site during that hospital’s outage, and earlier drew attention for claims against Australian vitamin maker Vitex. Dragos ranked the group the third most active ransomware operation in Q2 2026 with 125 claimed attacks.
For cardiovascular practices, the pattern is a reminder that single-specialty clinics are squarely in scope. These groups often run lean IT teams, and the attack timeline here, listing the same day as the estimated intrusion, suggests either fast data theft or an opportunistic claim. Practices should treat any suspicious login activity from external collaboration tools as an emergency, enforce multi-factor authentication on remote access, and keep an updated inventory of where patient data lives before an incident makes that question urgent.
