The Rhysida ransomware group says it walked off with 3.28 TB of data from Valley Health Team, a medical clinic, including databases it claims hold records for 160,870 patients.
Ransomware.live discovered the leak site listing on August 28. In the post, the group says the stolen files total 9,056,196, drawn from “large SQL databases containing the clinic’s entire lifetime of information.” The claim cites major databases covering 4.18 million diagnoses and 7.6 million unencrypted EHR scans, alongside Social Security numbers, passport data, financial statements, salaries, and tax records.
The group’s post invites interested parties to contact it, noting “there are plenty of files here that can be monetized.”
The claim is unconfirmed, and no breach notification has been published by the clinic. Rhysida has a documented pattern of targeting healthcare, including dental practices and Australian clinics, and frequently auctions stolen data rather than publishing it outright.
If accurate, the disclosure would put highly sensitive clinical data in the hands of criminals, and the group’s specific mention of unencrypted EHR scans is a reminder that protected health information should be encrypted both at rest and in transit. Clinics that see their name on a leak site should treat the listing as an active incident: contain affected systems, preserve logs, engage forensic help, and prepare for the notification obligations that follow a confirmed breach.
