CHASI (A part of Sun River Health) listed on Genesis ransomware leak site

• Ransomware group: Genesis
• Country: United States
• Sector: Healthcare
• Announcement date: February 13, 2026

Genesis ransomware group claims data breach at CHASI

The threat actor known as Genesis has listed CHASI, a United States-based healthcare organization, on its leak site. The group claims to have successfully exfiltrated data belonging to the entity, which operates as a part of Sun River Health. This announcement marks a significant escalation in the threat landscape facing the organization, as the group has moved to publicize the incident following a failed negotiation process.

According to the claims made by the threat actor, the incident occurred on February 13, 2026. The Genesis group stated that the organization refused to make a payment during the negotiation process. As a direct consequence of this refusal, the group has threatened to publish the stolen information on their leak site. While the group is actively engaging in these extortion tactics, public information regarding the specific technical methods or the background of this group remains limited in the public domain.

Claimed data contents and affected information

The announcement made by the Genesis group claims that the stolen data is highly sensitive and includes a vast array of personal and administrative records. The threat actor alleges that the breach involves over 60,000 records specifically related to HIV-tested patients. This inclusion of highly sensitive medical information significantly increases the potential impact of the leak on the individuals involved.

Beyond the specific medical records, the group claims to have access to a wide variety of other data types, including:

• Patient health records
• Personal data
• Financial data
• Tax records
• Contracts
• Human resources records

The presence of such diverse data types suggests a comprehensive breach of the organization's digital environment, spanning from clinical patient information to internal corporate documentation.

Potential impact and industry implications

This alleged data breach may pose significant risks to the individuals whose information has been compromised. The exposure of sensitive health information, particularly regarding HIV testing, creates a high risk for identity theft and targeted phishing attacks against the victims. When such specific and private medical details are leaked, the potential for social engineering and long-term harm to individuals is greatly increased.

Furthermore, because CHASI operates within the healthcare sector, this incident could lead to significant compliance issues and regulatory penalties under the Health Insurance Portability and Accountability Act (HIPAA) in the United States. The group's use of double extortion tactics—whereby data is both encrypted and stolen to be used as leverage—suggests a strategic attempt to undermine the organization's operational continuity and damage its reputation. The potential publication of this data may result in long-term security and legal consequences for both CHASI and its parent entity, Sun River Health.

In the broader context of cybersecurity, ransomware groups frequently use leak sites to exert maximum pressure on victims. By threatening to release sensitive data, attackers aim to bypass the traditional recovery methods of restoring from backups, instead targeting the organization's legal and reputational standing. For organizations in the healthcare sector, maintaining robust defensive measures is critical. This includes implementing strict access controls, ensuring comprehensive encryption for data at rest and in transit, and maintaining rigorous monitoring of network activities to detect unauthorized exfiltration attempts. Organizations must also prepare for the regulatory scrutiny that follows such incidents, ensuring that incident response plans account for both technical recovery and legal compliance requirements.