Loading story…
Woodfords Family Services said a Medusa ransomware attack discovered on April 8, 2024 exposed the personal information and protected health information of 8,073 individuals, including 7,701 Maine residents. The Maine disability services provider reported that unauthorized access affected files and folders on its network, and a later review found data including names, Social Security numbers, driver’s license numbers, financial account information, health insurance details, and diagnosis and treatment information. The breach was initially reported to HHS in June 2024 with a placeholder figure of at least 500 affected people, while the full scope was not confirmed until internal review and data mining concluded in early 2026.
Woodfords issued preliminary and media notices in 2024 and mailed final notification letters on March 27, 2026, after determining which individuals were affected. The organization is offering 12 months of credit monitoring and identity theft protection to impacted people. The incident marks Woodfords’ second ransomware-related breach in two years, following a separate 2023 attack that affected 17,285 individuals, including PHI tied to 6,691 people.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-27, Woodfords publicly disclosed the breach details, including the final affected population and the nature of the exposed data. Reporting also identified Medusa as the ransomware group that accessed the network.
On 2026-03-27, Woodfords mailed notification letters to affected individuals and said 8,073 people were impacted, including 7,701 Maine residents. The organization also offered 12 months of credit monitoring and identity theft protection.
On 2026-01-29, after data mining and internal review, Woodfords confirmed that the compromised files contained personal information and protected health information. Reported data types included Social Security numbers, driver's license numbers, financial account information, health insurance information, and diagnosis and treatment details.
Also in June 2024, Woodfords reported the incident to the HHS Office for Civil Rights as a ransomware-related breach. The filing used a placeholder estimate of at least 500 affected individuals.
In June 2024, Woodfords issued preliminary and media notices about the April 2024 breach. At that stage, the organization had not yet determined the full scope of affected individuals.
On 2024-04-08, Woodfords Family Services discovered suspicious activity on its network and determined that unauthorized access affected files and folders the same day. Later reporting characterized the incident as a ransomware attack.
In June 2023, Woodfords Family Services experienced an earlier ransomware-related breach. Reporting says that incident affected 17,285 individuals, including protected health information belonging to 6,691 people.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sandhills Medical Foundation, a South Carolina healthcare provider, notified patients that a ransomware-related breach exposed the data of **169,017 people** after an unauthorized party accessed a server and stole files. The organization said it discovered the incident on **May 8, 2025** after system disruptions initially linked to a vendor-related technical issue, and a subsequent forensic investigation determined that data had been exfiltrated from systems affecting select patients. The compromised information reportedly included sensitive **personal, financial, and health data**, raising risks of identity theft and medical privacy exposure. The ransomware group **Inc** later claimed responsibility and added Sandhills to its leak site on **May 30, 2025**, though Sandhills did not publicly confirm the gang's involvement and said it **did not pay a ransom**; reporting also noted the case as one of the larger healthcare breaches attributed to the group.
Jun 29, 2026
Brown Health Medical Group-MA disclosed a data breach affecting **311,760 individuals** after unauthorized activity was discovered on a legacy file server at its Hawthorn location in December 2025. The organization said the intrusion was limited to that historic file server and did **not** affect its electronic medical record or electronic health record systems, but a June 22, 2026 review found that files on the server had been accessed. The exposed information potentially included names, contact details, dates of birth, Social Security numbers, driver’s license and other government ID numbers, medical and disability records, financial account information, payment card data, and employment-related records. Brown Health Medical Group-MA reported the incident to the **HHS Office for Civil Rights** and state authorities in Massachusetts and Vermont, said no threat actor had been publicly identified or linked to a ransomware or extortion claim, and is offering affected individuals **24 months** of credit monitoring, fraud detection, and identity theft protection services.
Aug 6, 2026
Multiple U.S. healthcare organizations reported **unauthorized network access and patient data exposure**, with several incidents involving confirmed **data exfiltration** and follow-on notification/credit-monitoring actions. **QualDerm Partners** disclosed unauthorized access between **Dec. 23–24, 2025** with files exfiltrated and notifications being sent on a rolling basis, while **Carolina Foot & Ankle Associates** reported a **Dec. 2025** intrusion detected after a network disruption and confirmed exfiltration of files containing PHI (e.g., demographics, MRNs, insurance data, and treatment/billing codes). Additional breach disclosures included **Cedar Point Health** (intrusion detected around **June 16, 2025**, with a months-long data review concluding in late Jan. 2026 and impacted data potentially including SSNs/ITINs and government IDs) alongside separate notifications from **Wee Care Pediatrics** and **Easterseals Northeast Indiana**. Legal and regulatory consequences continued to surface from earlier healthcare incidents. **Asheville Eye Associates** agreed to settle consolidated class-action litigation tied to a **Nov. 2024** attack claimed by **DragonForce ransomware**, which allegedly exfiltrated **~540 GB** before encrypting systems and later leaked data when ransom was not paid; the breach was reported to HHS OCR as affecting **204,984** individuals. Sector-wide reporting also indicated **46** large healthcare breaches logged for **Jan. 2026** on the HHS OCR portal (500+ individuals), exposing **~1.44 million** individuals’ PHI, amid discussion that late-2025 reporting backlogs may have influenced recent month-to-month trends.
Jun 29, 2026