Grandview Family Medicine targeted by Medusa ransomware group

• Ransomware group: Medusa
• Country: United States
• Sector: Healthcare
• Announcement date: February 14, 2026

Medusa ransomware group claims attack on Grandview Family Medicine

The threat actor known as Medusa has published a claim on its leak site regarding a cyberattack against Grandview Family Medicine. According to the announcement made on February 14, 2026, the group alleges that it has successfully exfiltrated sensitive information belonging to the United States-based healthcare provider.

The group claims that the ransomware attack occurred on February 8, 2026. As part of their extortion attempt, the threat actor is demanding a ransom payment of 100,000 USD. The group has stated that this payment is required in exchange for not publishing the stolen data on their public leak site.

Details of the claimed data breach

The Medusa group has provided evidence of the breach through screenshots that purportedly show various medical documents. These documents appear to contain highly sensitive information related to patient health and clinical diagnostics. The leaked content reportedly includes a variety of medical records that could be used for malicious purposes.

The specific types of data identified in the claim include:

• Patient health records
• Medical laboratory results
• Personal health information

The presence of such detailed medical documentation, including biochemistry panels and cholesterol levels, highlights the sensitive nature of the information the group claims to have obtained. The exposure of such data typically involves a combination of clinical and personal identifiers.

Impact and implications of the incident

The use of double extortion by the Medusa group is a significant concern. In a double extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to leak the information publicly, the attackers increase the pressure on the victim to meet ransom demands, even if the organization has backups to restore its systems.

The exposure of this sensitive medical information poses substantial risks to the individuals involved. The availability of patient laboratory results and personal health information can lead to risks of identity theft and fraud. Furthermore, the healthcare provider may face significant legal and regulatory consequences. In the United States, breaches involving protected health information are subject to strict oversight under HIPAA regulations regarding data privacy and security.

For healthcare institutions, such incidents can lead to long-term negative effects on patient trust and can severely disrupt operational continuity. When an organization faces such a breach, it may need to initiate formal processes to notify all affected individuals and conduct a thorough review of its cybersecurity measures to prevent future occurrences. Strengthening defensive postures often involves implementing robust encryption, multi-factor authentication, and continuous monitoring to detect unauthorized data exfiltration.