Loading story…
Bayhealth Medical Center in Delaware has agreed to a preliminary settlement in a class action lawsuit following a 2024 ransomware attack by the Rhysida gang. The breach affected nearly 500,000 individuals, exposing sensitive personal and health information, and led to allegations of negligence and inadequate security practices. The lawsuit also claims Rhysida demanded a $1.4 million ransom and published stolen data on the dark web.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Bayhealth reached a preliminary settlement in the proposed class action tied to the 2024 Rhysida ransomware and data-theft incident. The settlement was reported in September 2025.
Bayhealth reported the incident to the U.S. Department of Health and Human Services as a HIPAA breach affecting 497,047 individuals. The filing stated that attackers had accessed the network and exfiltrated files.
In August 2024, plaintiffs filed a proposed class action lawsuit alleging negligence and invasion of privacy over the Bayhealth incident. The suit sought damages and injunctive relief requiring Bayhealth to improve security to industry standards.
Bayhealth said it detected suspicious activity in its environment on 2024-07-31, triggering its response to the ransomware and data-theft incident.
Bayhealth later determined that threat actors accessed its network between 2024-07-27 and 2024-07-31 and exfiltrated certain files. The incident was attributed in reporting and litigation to the Rhysida ransomware gang.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Richmond Behavioral Health Authority (RBHA) and MedStar Health, two major healthcare providers in the Mid-Atlantic region, have disclosed significant ransomware incidents resulting in the exposure of sensitive patient data. RBHA reported that hackers gained unauthorized access to its systems on September 29, 2025, deploying ransomware that encrypted files containing personal and protected health information for up to 113,232 individuals. Although RBHA stated there was no definitive evidence of patient data being accessed, the organization is notifying all potentially affected individuals and has implemented enhanced security measures, including third-party monitoring and stronger data policies. MedStar Health, which operates hospitals and care sites across Maryland, Virginia, and Washington D.C., confirmed a separate ransomware attack attributed to the Rhysida group, which claims to have exfiltrated 3.7 terabytes of data, including over 7 million pieces of patient information. The breach, occurring between September 12 and 16, 2025, involved the compromise of names, dates of birth, Social Security numbers, and detailed patient care information. MedStar has begun notifying affected patients and is offering complimentary identity monitoring services to those whose most sensitive data was exposed. Both incidents highlight the ongoing threat of ransomware to healthcare organizations and the significant risks to patient privacy and data security.
Jun 29, 2026
Memorial Hospital and Manor, a small community hospital in Georgia, has agreed to settle a class action lawsuit following a 2024 ransomware attack allegedly perpetrated by the Embargo cybercrime gang. The attackers claimed to have stolen 1.15 terabytes of sensitive data, which was subsequently leaked on the dark web. The breach affected approximately 105,170 current and former patients, and the hospital is offering settlement options, including payments of up to $5,000 for documented losses such as identity theft, fraud, and related expenses. The hospital, which includes both an 80-bed facility and a 107-bed long-term care center, is owned by the Hospital Authority of the City of Bainbridge and Decatur County. The settlement provides compensation for out-of-pocket expenses incurred as a result of the breach, including costs for credit monitoring, credit report fees, and replacement of identification documents. This resolution follows significant concern over the impact of the data leak on the affected community and highlights the ongoing risks posed by ransomware attacks on healthcare institutions.
Jun 29, 2026
Cookeville Regional Medical Center in Tennessee disclosed that a ransomware attack tied to the **Rhysida** gang exposed the personal, financial, and protected health information of **337,917 individuals**. The hospital said an unauthorized party accessed its network between **July 11 and July 14, 2025**, and a forensic investigation later determined that files may have been viewed or stolen during that period. Exposed data varied by individual and could include names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account details, medical information, medical record numbers, and health insurance information. Rhysida claimed responsibility for the intrusion, saying it exfiltrated about **538 GB** of data and later listed the medical center on its dark web leak site, where it said **70%** of the data had been leaked. The breach was initially reported to HHS with a placeholder figure before a full file review was completed in March 2026, after which the hospital began broader notifications. Cookeville Regional said it has not found evidence of misuse so far, urged affected people to monitor accounts and explanation-of-benefits statements, and offered **12 months** of credit monitoring and identity theft protection.
Jun 29, 2026