Comprehensive Orthopaedics and Musculoskeletal Care, LLC targeted by crypto24

• Ransomware group: crypto24
• Country: United States
• Sector: Healthcare
• Announcement date: March 9, 2026

Crypto24 claims a data leak involving Comprehensive Orthopaedics and Musculoskeletal Care, LLC

The threat actor known as crypto24 has posted an announcement on its leak site claiming responsibility for a data breach involving Comprehensive Orthopaedics and Musculoskeletal Care, LLC. According to the claims made by the group, the data belonging to the healthcare provider has been leaked. While the group has listed the organization on its platform, information regarding the specific identity and background of this threat group remains limited.

The announcement was made on March 9, 2026, which coincides with the date the attack was allegedly carried out. This type of activity is common in the landscape of modern cyberattacks, where threat actors use leak sites to host stolen information to exert pressure on their targets. These sites serve as a public gallery for stolen data, often used in double extortion tactics where an organization is pressured to pay a ransom not only to decrypt their systems but also to prevent the public release of sensitive information.

Details of the alleged data breach

The claims made by crypto24 suggest a significant scale regarding the potential impact of this incident. The group asserts that the stolen data includes information pertaining to over 100,000 individuals. Despite the large number of individuals mentioned, the group has not provided any screenshots to substantiate their claims, and no specific information was provided regarding the total size of the data or the specific file count involved in the leak.

The content of the leaked information is described as being highly sensitive. Specifically, the announcement claims that the data includes personal information that is protected under the Health Insurance Portability and Accountability Act (HIPAA). The types of data allegedly compromised include:

• Personal health records

In many ransomware scenarios, the exposure of such sensitive information is used as leverage. By threatening to release protected health information, attackers aim to maximize the reputational and legal pressure on the victim organization.

About Comprehensive Orthopaedics and Musculoskeletal Care, LLC

Comprehensive Orthopaedics and Musculoskeletal Care, LLC is a healthcare provider based in Connecticut. The institution specializes in providing orthopaedic and musculoskeletal health services to its patient population. Their medical service offerings include various specialized treatments, such as orthopaedic surgery, physical therapy, and pain management services.

Potential implications and organizational security

The claims made by crypto24 may pose significant risks to the patient privacy and the data security protocols established by the institution. Under HIPAA regulations, the exposure of protected health data can lead to serious consequences for a healthcare organization, including potential legal sanctions and administrative fines. Furthermore, the individuals whose data is allegedly involved may face secondary risks, such as identity theft or being targeted by sophisticated phishing attacks.

When such a breach is alleged, organizations are often required to fulfill specific legal obligations, such as data breach notification requirements, which involve informing the affected parties about the compromise of their information. To defend against such threats, organizations in the healthcare sector typically focus on robust security frameworks, including strict access controls, encryption of sensitive data at rest and in transit, and continuous monitoring of their networks to detect unauthorized access.

The method employed by the threat group, which involves publishing data to a leak site, appears to be a tactic intended to pressure the institution through public exposure. This highlights the ongoing challenge faced by healthcare providers to protect highly sensitive medical records against evolving ransomware threats.