Florida Orthopaedic Associates listed on sinobi ransomware leak site

• Ransomware group: sinobi
• Country: United States
• Sector: Healthcare
• Announcement date: December 16, 2025

The threat actor known as sinobi has officially listed Florida Orthopaedic Associates on its ransomware leak site. The announcement, made on December 16, 2025, marks a significant escalation in the ongoing threat landscape facing healthcare providers. While the listing serves as a public claim by the threat actor, it highlights the increasing trend of double extortion tactics used by ransomware groups to pressure victims.

Details of the claim

According to the announcement posted by the sinobi group, the organization's data has been encrypted. The threat actor claims that the attack occurred on December 16, 2025, the same day the listing appeared on their leak site. In conjunction with the encryption claim, the group has issued a ransom demand totaling 1,210,000 USD.

Ransomware attacks often follow a pattern where attackers first gain access to a network, move laterally to identify high-value assets, and finally deploy encryption software to lock the victim out of their own systems. In many modern cases, attackers also exfiltrate sensitive data before encryption, using the threat of public exposure as additional leverage to ensure payment. This method, known as double extortion, significantly increases the pressure on organizations to comply with financial demands.

Data involvement and evidence

Regarding the specific information targeted in this incident, the provided screenshots offer visual evidence of the organization's file directories. However, the text of the announcement does not explicitly state any specific data types that may have been compromised. The listing names no specific data types.

In such scenarios, the lack of immediate clarity regarding the exact files stolen is a common challenge for incident responders. While visual evidence of directories confirms that the attackers navigated the file system, the actual content of those files remains unconfirmed by the source. Organizations facing similar threats typically focus on identifying the scope of the breach by analyzing logs and monitoring for unusual data egress patterns.

About Florida Orthopaedic Associates

Florida Orthopaedic Associates is an orthopedic healthcare provider based in Central Florida. The organization specializes in several key areas of medical care, including joint replacement, spine treatments, and sports medicine. Established in 1969, the organization has a long-standing presence in the medical community and operates multiple clinics. Their services encompass a wide range of medical interventions, offering both surgical and non-surgical treatment options to their patients.

Potential impact and industry implications

This situation may lead to significant disruptions in the organization's operational processes. For a healthcare provider, any interruption in digital systems can impact the delivery of patient care and clinical workflows. Furthermore, as an entity operating within the healthcare sector, the potential exposure of patient data could create substantial legal risks under HIPAA regulations. Compliance with such regulations is critical for maintaining patient privacy and avoiding significant regulatory penalties.

Beyond the immediate operational and legal concerns, secondary risks may include the potential use of leaked information for identity theft or targeted phishing attacks. When sensitive information is leaked, it can be repurposed by other malicious actors to conduct more sophisticated social engineering campaigns against both the organization and its patients.

For organizations in the healthcare sector, maintaining robust defensive postures is essential. This includes implementing strict access controls, maintaining offline backups, and conducting regular security awareness training for staff. As the methods of groups like sinobi remain limited in the public domain and have not yet been fully analyzed, healthcare entities must remain vigilant against evolving tactics used by ransomware operators.