Heart South Cardiovascular Group listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United States
• Sector: Healthcare
• Announcement date: November 10, 2025

The Rhysida ransomware group has published a listing on its dedicated leak site, claiming that it has successfully targeted the Heart South Cardiovascular Group. The announcement, which appeared on November 10, 2025, suggests a significant security breach involving the exfiltration of sensitive information belonging to the healthcare provider.

The claimed attack and data exfiltration

According to the claims made by the Rhysida group, the threat actors gained unauthorized access to the systems of the Heart South Cardiovascular Group. The group asserts that this access allowed them to exfiltrate sensitive data from the organization's internal environment. This type of activity is a hallmark of modern ransomware operations, where the goal is not just to encrypt local files, but to steal information to use as leverage.

The group has provided evidence to support its claims by publishing screenshots of what they allege are stolen files. These samples include various documents that appear to be highly sensitive in nature. While the group has posted these samples to demonstrate the success of their operation, there is no detailed information available regarding the full scope or the total nature of the leaked data. The exact volume of the data stolen remains unknown, as the group has not provided specific details regarding the total file count or the total size of the stolen datasets.

Affected data types

Based on the samples provided by the threat actor, the following types of information are believed to be involved in the breach:

• Identity information
• Medical records

The visual evidence shared by the group includes samples of Alabama driver's licenses and various medical documents, indicating that the stolen information contains highly personal identification and health-related details.

About Heart South Cardiovascular Group

Heart South Cardiovascular Group is a healthcare provider located in the United States. The organization offers comprehensive cardiac and vascular care within Central Alabama. It specializes in providing medical services specifically designed for the diagnosis and treatment of heart and vascular diseases.

Risk assessment and industry implications

This incident presents significant risks due to the potential exposure of sensitive data from a healthcare provider. Because the organization is based in the United States, the breach may lead to legal implications and mandatory breach notifications under HIPAA regulations. The exposure of medical records is particularly concerning as it may have long-term negative impacts on patient privacy.

The tactics employed by the Rhysida group reflect a trend toward double-extortion. In these scenarios, attackers not only encrypt an organization's data but also threaten to leak it publicly to increase pressure for ransom payments. The leaked data, which includes identity information, could potentially be used for identity theft or targeted phishing campaigns against the affected individuals.

For organizations operating within the healthcare sector, such incidents highlight the critical importance of robust cybersecurity frameworks. To defend against these types of threats, organizations often implement defensive measures such as multi-factor authentication, regular security awareness training, and comprehensive data encryption. Furthermore, maintaining rigorous access controls and monitoring network traffic for unusual exfiltration patterns are essential steps in mitigating the impact of unauthorized access. The history of the Rhysida group suggests a specific tendency to target healthcare institutions, making these organizations a primary focus for such threat actors.