The Insomnia ransomware group has added a Maryland skilled nursing operator to its leak site, claiming it stole internal data from Aurora Health Management, the company behind a rehab center in Frederick.
Threat trackers logged the listing on August 19. Ransomware.live recorded the discovery at 14:57 UTC with an estimated attack date of July 27, and RansomLook carried the same claim the same day. GalaxyWarden rated it high severity while flagging it as unverified.
Aurora Health Management describes itself as a skilled nursing and rehab center with nearly 25 years in long-term care, taking over troubled facilities and running them to Medicare and Medicaid standards. The company has not publicly confirmed an intrusion, and the gang has not published sample files or a victim count.
Long-term care providers are a repeated ransomware target because downtime can interrupt medication administration, therapy schedules, and hospital transfers. The Insomnia operation appears to be an emerging crew, and its listing carries the standard unverified caveat until the claim is independently confirmed or the operator responds.
Skilled nursing operators should treat leak-site listings as a signal to verify their own posture, confirm backup integrity, and review remote access logs even when no alert has fired.
