A nonprofit health center serving four Indiana counties told patients this month that an intruder spent two days inside its systems in August, and the extortion crew behind the break-in says it already published the files.
NorthShore Health Centers, which runs clinics across Porter, Lake, La Porte, and Jasper Counties, detected suspicious network activity on August 10. Outside forensics help traced unauthorized access to August 10 through August 11. A website notice dated October 14 said the data review was still running, so the patient count remains unconfirmed.
The crew did not wait for the count
A ransomware group calling itself Insomnia claimed the health center and posted it to a dark web leak site, threatening publication if no payment arrived. It then released the material anyway. The HIPAA Journal, which did not download the files, reported that the directory structure suggests patient records are inside.
NorthShore told patients it will mail letters once the review closes. Likely categories include names, Social Security numbers, treatment details, and insurance information.
Leak site moves ahead of the mail room
The sequence has become routine, and it inverts the notice timeline healthcare organizations were built around. A listing now frequently precedes the federal breach report, the forensic conclusion, and the patient letter, leaving compliance teams explaining a disclosure they cannot yet fully describe. Insomnia has claimed several small US care providers this year, including a safety-net community health center in September and a Tulsa foot and ankle chain in August.
For patients, the practical window is short. NorthShore advised a fraud alert and a credit freeze with one of the three major bureaus, plus close reading of explanation of benefits statements for services never received.
