Loading story…
Sunflower Medical Group, a healthcare provider serving Kansas and Missouri, has agreed to pay $1.2 million to settle a class action lawsuit following a ransomware attack attributed to the Rhysida cybercrime gang. The breach compromised sensitive data of nearly 256,000 individuals, with Rhysida claiming responsibility and listing Sunflower Medical as a victim on its leak site. Under the preliminary court-approved settlement, affected individuals can claim a one-time cash payment or submit receipts for out-of-pocket losses, while plaintiff attorneys have requested half of the settlement for fees and expenses. Sunflower Medical has also committed to providing a confidential declaration on additional cybersecurity safeguards implemented to mitigate future breaches.
The final approval hearing for the settlement is scheduled in Missouri state court. The Rhysida group, known for targeting healthcare organizations, claims to have stolen an SQL database from Sunflower Medical. The incident highlights ongoing risks to healthcare data security and the legal and financial consequences organizations face following ransomware attacks. No evidence from the provided references suggests that the breach involved other medical groups or was part of a broader coordinated attack beyond Sunflower Medical Group.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
A final approval hearing for the proposed settlement was scheduled in Missouri state court for March 6. The lawsuit alleged negligence, breach of fiduciary duty, and violations of state laws.
By December 2025, Sunflower Medical agreed to pay $1.2 million to settle a class action lawsuit over the breach. The settlement also included victim compensation options and commitments to additional cybersecurity safeguards.
As of December 2025, the Rhysida gang still listed Sunflower Medical Group as a victim on its leak site. This indicated the stolen data remained part of the group's public extortion pressure campaign.
In March 2025, Sunflower Medical notified federal and state regulators about the incident. Reported compromised data included driver's license images, health insurance cards, and Social Security numbers.
Sunflower Medical discovered the breach in January 2025 after the December 2024 attack. The incident ultimately affected nearly 256,000 individuals.
In December 2024, Sunflower Medical Group suffered a ransomware attack later attributed to the Rhysida cybercrime gang. The attackers allegedly stole more than 3 terabytes of data from the healthcare provider.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bayhealth Medical Center in Delaware has agreed to a preliminary settlement in a class action lawsuit following a 2024 ransomware attack by the Rhysida gang. The breach affected nearly 500,000 individuals, exposing sensitive personal and health information, and led to allegations of negligence and inadequate security practices. The lawsuit also claims Rhysida demanded a $1.4 million ransom and published stolen data on the dark web.
Jun 29, 2026
OneBlood, a non-profit organization supplying blood to 250 hospitals across four states, experienced a significant ransomware attack in July 2024. The cybercriminals gained unauthorized access to OneBlood's computer network between July 14 and July 29, 2024. As a result of this breach, the personal information of approximately 167,400 individuals was compromised or potentially exposed. The compromised data included names, Social Security numbers, payment card information, and sensitive medical data. Following the incident, OneBlood faced a proposed class action lawsuit from affected individuals. To resolve the litigation, OneBlood agreed to a $1 million settlement, which was preliminarily approved by a Broward County, Florida circuit court. Under the terms of the settlement, affected individuals are eligible to claim up to $2,500 for documented losses or opt for a $60 cash payment. A final court hearing regarding the settlement is scheduled for December 9. OneBlood has denied any wrongdoing in connection with the incident. The attack on OneBlood was part of a broader trend, as several other blood suppliers in the US and UK also suffered cyber incidents during the same period. The breach highlighted the vulnerability of healthcare and critical infrastructure organizations to ransomware attacks. The incident prompted OneBlood to notify all affected donors and individuals whose data may have been compromised. The organization undertook an internal investigation to determine the scope and impact of the breach. The settlement aims to provide financial relief to those impacted by the exposure of their sensitive information. The case underscores the increasing financial and reputational risks faced by healthcare providers in the wake of cyberattacks. The attack and subsequent settlement have drawn attention to the need for enhanced cybersecurity measures in the healthcare sector. The incident also serves as a warning to other organizations handling sensitive personal and medical data. Regulatory scrutiny and litigation risks are likely to increase for organizations that experience similar breaches. The OneBlood case demonstrates the potential costs and consequences of ransomware attacks on critical service providers.
Jun 29, 2026
Heritage Provider Network, one of the largest physician-owned healthcare networks in the United States, and nine of its affiliated physician practices have agreed to pay nearly $50 million to settle consolidated class action lawsuits stemming from a major ransomware and data theft incident in December 2022. The breach affected more than 3.4 million current and former patients, whose sensitive personal and medical information was compromised. The impacted practices include Regal Medical Group, Lakeside Medical Organization, Greater Covina Medical Group, Affiliated Doctors of Orange County Medical Group, Arizona Health Advantage, AZPC Clinics, Community Surgery Center of Glendale, Pacific Family Hospice, and Valley’s Best Hospice. Plaintiffs in the lawsuits alleged that the compromised data, which included names, Social Security numbers, addresses, dates of birth, and medical information, was leaked on the dark web. Notices about the breach were sent to affected individuals in early 2023, alerting them to the exposure of their information. The $49.9 million settlement provides each class member with three years of complimentary identity and theft monitoring services. Eligible class members who submit valid claims can receive cash payments of up to $10,000 for documented fraud or out-of-pocket expenses related to the breach. The settlement aims to address the alleged failure of Heritage Provider Network and its affiliates to adequately protect patient data, as detailed in the class action complaints. The legal resolution covers an estimated 3,413,000 individuals who received notification of the breach. The settlement was reached after plaintiffs claimed that the defendants’ security measures were insufficient to prevent the ransomware attack and subsequent data theft. The incident has highlighted the ongoing risks faced by healthcare organizations in protecting sensitive patient information from cybercriminals. The settlement also underscores the significant financial and reputational consequences that can result from large-scale healthcare data breaches. Heritage Provider Network and its affiliates have not admitted wrongdoing but agreed to the settlement to resolve the litigation. The case serves as a reminder for healthcare providers to continually assess and strengthen their cybersecurity posture to mitigate the risk of future incidents. The settlement is one of the largest in recent years for a healthcare data breach, reflecting the scale and impact of the incident. Affected patients are encouraged to review the settlement terms and submit claims if eligible.
Jun 29, 2026