Qilin added two US medical practices to its leak site on Monday: Premier Medical Group, a Hudson Valley multispecialty network, and Mountain Rheumatology, a Denver arthritis practice.
Both listings carried the same timestamp window on October 26, roughly seven minutes apart, and neither came with the data volume or file counts the group usually advertises. Premier Medical Group runs urology, cardiology, gastroenterology, rheumatology, dermatology and primary care offices across roughly ten sites in New York’s Hudson Valley. Mountain Rheumatology practices from a single Denver address. Threat trackers including HookPhish, CTIWatch and Ransomware.live logged both entries, and neither organization has publicly confirmed the intrusion or notified patients.
A group with a catalog of hospital victims
Qilin has spent the past year on healthcare. The gang has been tied to listings at US hospitals and dental groups and to exploitation of edge networking devices at provider networks. CTIWatch correlates the Premier claim with two critical flaws, CVE-2026-20079 in Cisco Secure Firewall Management Center and CVE-2026-0257 in Palo Alto Networks PAN-OS GlobalProtect, both on CISA’s known exploited list. Correlation is not attribution, but it matches the pattern of VPN and firewall appliances as entry points.
Small specialty practices remain the softest targets: no dedicated security staff, legacy billing systems, and patient identity data sitting in flat files. Cover the basics, patch internet-facing gateways, and rehearse a downtime plan.
