The ransomware claim from threat actor rhysida states that Valley Health Team 9,056,196 files were encrypted/exfiltrated, including large SQL databases containing the clinic’s entire lifetime of information. The reported impact includes 160,870 patients, 4.18 million diagnoses, 7.6 million unencrypted EHR scans with SSNs/passports and financial records, ending with the impacted country(s): #unknown
Incident Details
- Victim: Valley Health Team
- Sector: Healthcare
- Country:
- Actor: rhysida
- Source: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?company=265
- Discovered: 2026-08-28T15:34:19.946911+00:00
- Published: 2026-08-28T15:33:29.246015+00:00
Information
- 9,056,196 files
- 3.28 TB of data
- Large SQL databases containing the clinic’s entire lifetime of information
- Major databases with 160,870 patients
- 4.18 million diagnoses
- 7.6 million unencrypted EHR scans
- SSN, passports, and other personal data
- Financial statements, salaries, and taxes
- Message indicating the data can be monetized
Disclaimer: This post is based on public claims made by the ransomware group "rhysida". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.