Flint Hills Dialysis listed on Insomnia ransomware leak site

• Ransomware group: Insomnia
• Country: United States
• Sector: Healthcare
• Announcement date: February 7, 2026

The threat actor group known as Insomnia has claimed responsibility for a data breach involving Flint Hills Dialysis. According to an announcement posted on the group's leak site on February 7, 2026, the group alleges that they have successfully exfiltrated and published sensitive documents belonging to the healthcare institution.

The claimed attack and event details

The Insomnia group has officially listed Flint Hills Dialysis on their dedicated leak site, a common tactic used by ransomware operators to exert pressure on victims. The group claims that the breach occurred on December 4, 2025. Through this public listing, the attackers have published various documents that they allege belong to the organization, specifically targeting documents related to the institution's healthcare operations.

By publishing these files, the group appears to be attempting to create significant pressure on the organization. While the group's specific motives and methods are difficult to fully ascertain due to limited public information regarding their operations, the act of leaking sensitive files is a hallmark of modern cyber extortion. This behavior suggests a strategic attempt to damage the reputation of the victim or force compliance through public exposure.

The nature of the leaked data

The information released by the group allegedly includes a wide variety of sensitive documents. Based on the evidence provided in the leak announcement, the compromised data includes:

• Staff contact information
• Medical staff records
• Identification data
• Insurance information
• Contractual documents

Specifically, the leaked content is reported to include emergency staff contact lists, forms regarding medical staff reappointment, various identification cards, Medicare health insurance cards, and lease agreements for medical buildings. No specific information was provided regarding the total size of the data breach or the total number of files involved.

About Flint Hills Dialysis

Flint Hills Dialysis is a healthcare organization that specializes in the management of chronic kidney disease and the provision of dialysis services. The institution operates clinical facilities located in Manhattan and Marysville, Kansas. The organization focuses on providing personalized treatment plans and offering patient education services to those under its care.

Analysis and potential implications

The data allegedly leaked contains highly sensitive personal health and identification information. For institutions operating within the healthcare sector, the exposure of such data is particularly critical. This type of breach can lead to significant secondary risks for the individuals whose information has been compromised, including the potential for identity theft and the execution of targeted phishing attacks.

Because the affected organization is located in the United States, the breach may trigger complex legal and administrative consequences. Specifically, the exposure of protected health information may lead to legal processes and administrative sanctions under HIPAA regulations regarding data privacy. Furthermore, the release of personnel records and contractual documents can negatively impact the institution's operational security and its various business relationships.

The decision by the Insomnia group to publish such sensitive information indicates that they may be employing a double-extortion method. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal the data to threaten its public release. This method is designed to maximize leverage over the victim by targeting their reputation and regulatory standing. To defend against such threats, organizations in the healthcare sector often focus on robust data encryption, strict access controls, and comprehensive employee training to mitigate the risks of unauthorized access and exfiltration.