Loading story…
Goshen Medical Center in North Carolina and Medical Associates of Brevard in Florida are notifying over 700,000 patients of data breaches attributed to the now-dormant BianLian ransomware group. Compromised data includes sensitive personal and health information, with both clinics offering affected individuals 12 months of complimentary credit and identity monitoring. The BianLian group has not claimed new victims since March 2025, and security experts suspect the group may have rebranded due to negative publicity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
BankInfoSecurity and GovInfoSecurity reported that two clinics disclosed data breach notifications affecting a combined roughly 700,000 patients, with the incidents allegedly linked to the BianLian ransomware group. No earlier incident, attack, or remediation dates were provided in the reference content, so the disclosure date is inferred from publication.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sandhills Medical Foundation, a South Carolina healthcare provider, notified patients that a ransomware-related breach exposed the data of **169,017 people** after an unauthorized party accessed a server and stole files. The organization said it discovered the incident on **May 8, 2025** after system disruptions initially linked to a vendor-related technical issue, and a subsequent forensic investigation determined that data had been exfiltrated from systems affecting select patients. The compromised information reportedly included sensitive **personal, financial, and health data**, raising risks of identity theft and medical privacy exposure. The ransomware group **Inc** later claimed responsibility and added Sandhills to its leak site on **May 30, 2025**, though Sandhills did not publicly confirm the gang's involvement and said it **did not pay a ransom**; reporting also noted the case as one of the larger healthcare breaches attributed to the group.
Jun 29, 2026
Brown Health Medical Group-MA disclosed a data breach affecting **311,760 individuals** after unauthorized activity was discovered on a legacy file server at its Hawthorn location in December 2025. The organization said the intrusion was limited to that historic file server and did **not** affect its electronic medical record or electronic health record systems, but a June 22, 2026 review found that files on the server had been accessed. The exposed information potentially included names, contact details, dates of birth, Social Security numbers, driver’s license and other government ID numbers, medical and disability records, financial account information, payment card data, and employment-related records. Brown Health Medical Group-MA reported the incident to the **HHS Office for Civil Rights** and state authorities in Massachusetts and Vermont, said no threat actor had been publicly identified or linked to a ransomware or extortion claim, and is offering affected individuals **24 months** of credit monitoring, fraud detection, and identity theft protection services.
Aug 6, 2026
Several U.S. healthcare organizations have disclosed significant data breaches involving unauthorized access to patient and employee information. MedStar Health reported that an unauthorized third party accessed internal systems containing sensitive patient data, including names, dates of birth, Social Security numbers, and medical information. The Rhysida threat group claimed responsibility for this attack, alleging the exfiltration and leak of over 7 million pieces of patient data. Brevard Skin and Cancer Center also confirmed a cyberattack in which the Pear threat group claimed to have stolen 1.8 terabytes of data, affecting both patient and employee records with information such as Social Security numbers, health conditions, and billing details. Both organizations have offered complimentary credit monitoring and identity theft protection to affected individuals and are reviewing their cybersecurity measures. Henry Ford Health in Michigan disclosed an insider data breach affecting nearly 2,000 patients, resulting in the termination of the responsible employee and notification to those impacted. While details on the specific data accessed were not provided, credit monitoring services have been offered. These incidents highlight the ongoing risks faced by healthcare providers from both external threat actors and insider threats, emphasizing the need for robust security policies and continuous evaluation of protective measures to safeguard sensitive health information.
Jun 29, 2026