Carlyle Senior Care of Florence listed on insomnia ransomware leak site

• Ransomware group: insomnia
• Country: United States
• Sector: Healthcare
• Announcement date: February 7, 2026

Carlyle Senior Care of Florence has been listed on the leak site of the threat group known as insomnia. The announcement includes various administrative and medical documents that the group alleges belong to the institution.

The claimed attack and extortion attempt

The insomnia group has published data they claim belongs to Carlyle Senior Care of Florence on their leak site. According to the threat actor, they gained unauthorized access to the institution's network on 2025-10-31. The group appears to be using the public disclosure of this data as a means to exert pressure on the institution.

This tactic is a hallmark of modern ransomware operations, often referred to as double extortion. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. By threatening to release this information on a public leak site, the attackers aim to create significant leverage, hoping that the threat of reputational damage or regulatory scrutiny will compel the victim to pay a ransom.

Data types identified in the leak

The information disclosed by the group includes various sensitive files. Based on screenshots provided by the attackers, the data allegedly involves several categories of documentation. The specific items identified in the listing include:

• Patient admission records
• Medical forms
• Corporate administrative documents

The disclosure of such documents suggests a breach that touches upon both the clinical and the operational aspects of the facility. While the specific volume of data or the exact number of files has not been disclosed by the group, the presence of medical and administrative records indicates a potential exposure of highly sensitive information.

About Carlyle Senior Care of Florence

Carlyle Senior Care of Florence is a private nursing home and care facility located in South Carolina. The institution provides skilled nursing, memory care, rehabilitation, and assistance with daily living activities for elderly individuals.

Potential impact and industry implications

This leak may pose risks to the patient privacy and operational security of the healthcare institution. As the shared data may contain sensitive information protected under HIPAA regulations, the institution could face potential legal sanctions. Furthermore, there is a possibility that affected individuals may be exposed to identity theft or targeted phishing attacks.

Beyond the immediate privacy concerns for patients, the disclosure of corporate ownership and administrative data may damage the institution's commercial reputation. In the healthcare sector, maintaining the confidentiality of patient records is not only a regulatory requirement but a fundamental component of patient trust. When such data is compromised, the impact can extend from legal complications to a loss of confidence from the community served.

In general, organizations in the healthcare sector can take several defensive steps to mitigate these risks. Implementing robust access controls and multi-factor authentication can help prevent unauthorized network access. Regular security audits, comprehensive employee training to recognize phishing attempts, and maintaining offline, encrypted backups are also essential components of a modern cybersecurity posture. While information regarding the specific methods used by the insomnia group remains limited in the public domain, the incident highlights the ongoing vulnerability of healthcare providers to targeted extortion campaigns.