Providence, one of the largest nonprofit health systems in the United States, has been named on a ransomware crew’s leak site, and the group says it never needed to encrypt a single file. BYOD listed the organization on November 10, 2026, claiming 25GB of personal data – full names, email addresses, physical addresses, dates of birth and Social Security numbers.
A claim built on access, not encryption
The message posted with the listing is unusually explicit for a leak-site notice. BYOD says it did not lock the network, and that holding that capability back was meant to demonstrate how deeply it sits inside Providence’s environment. That framing describes a dwell-and-collect intrusion rather than a destructive ransomware event, a pattern that keeps patient care online while data leaves quietly and can run for months without tripping an availability alarm.
What a listing does and does not prove
The claim is unverified. Providence has not publicly confirmed an intrusion, and leak-site assertions routinely overstate volume and inflate data categories. Trackers logged discovery at 18:21 UTC on November 10. For a system of Providence’s scale, with dozens of hospitals and hundreds of clinics across seven states, even partial confirmation would be a significant HIPAA event. At 25GB, the haul may be a narrow slice of the estate rather than the whole.
Why the claim matters clinically
Healthcare defenders have spent years planning for downtime. A crew that prefers extortion over encryption punishes different controls: identity monitoring for service accounts, egress baselines on clinical data stores, and alerting on bulk pulls from scheduling and billing systems. Record-level access logs are the only way to establish scope later.
Treat the listing as a threat, not a confirmed breach. An OCR filing or public statement would turn the claim into a reportable event.
