Anubis added Santiam Hospital & Clinics, a community provider network in Stayton, Oregon, to its dark web page late on October 28, 2026, tagging the listing with a single sentence: a major medical data breach. Nothing accompanied it. No file tree, no gigabyte count, no redacted patient records.
Santiam has not issued a statement confirming an incident, and no regulatory notification has surfaced.
Anubis has a healthcare habit
The outfit has built a recognizable pattern of double-extortion claims against medical providers, from home care franchisors to medical groups listed alongside Caduceus and, earlier in the year, a Brockton acute care hospital where patient care was disrupted. Its listings frequently run ahead of any victim confirmation, which is why tracking services treat Anubis names as allegations first and evidence later.
The Oregon claim fits that template: a public hospital brand, a vague description, and the disclosure clock left to the operator.
Reading a thin listing correctly
An empty claim is not proof of nothing. It is also not proof of a breach. Hospitals commonly receive extortion demands over data scraped from public sources or taken from a single compromised mailbox, and gangs list first to add pressure before producing evidence.
For Santiam’s patients the practical step is to watch explanation-of-benefits statements and place a fraud alert. For other community providers, the incident is a reminder that leak-site monitoring should be paired with external attack surface checks, because the listing is often the first public signal a staff credential was reused.
