The Storm ransomware group has listed Our Hospice of South Central Indiana on its leak site, claiming data stolen from the end-of-life care organization.
Ransomware.live recorded the listing on August 27. The nonprofit provides hospice, palliative, personal, and bereavement care, along with specialized programs for veterans and pediatric patients, and says it serves 22 counties in southern Indiana with 24/7 support, operating out of Columbus, Indiana, with 51 to 200 employees.
The claim is unconfirmed, and the organization has not issued a public statement. GalaxyWarden’s tracker rates the listing high severity while marking the underlying claim as unverified.
Storm has spent the summer cycling through healthcare targets. In recent weeks the group has claimed an Indiana acute care hospital, an Indiana health network, the Canadian Mental Health Association, and a Kentucky equine hospital, according to MedRisk’s ongoing coverage.
Hospice organizations hold some of the most sensitive records in healthcare, including end-of-life care plans, medication schedules, and family information, and many run on limited IT budgets with little dedicated security staff. A leak site listing with no prior notification typically signals an intrusion that predates public awareness. Providers should audit email accounts and remote access, verify backup integrity, and watch for data appearing on public channels while awaiting official confirmation.
