Markham Stouffville Hospital targeted by Anubis ransomware group

• Ransomware group: Anubis
• Country: Canada
• Sector: Healthcare
• Announcement date: December 16, 2025

Anubis group claims data breach at Markham Stouffville Hospital

The Anubis ransomware group has officially listed Markham Stouffville Hospital on its dedicated leak site. In the announcement, the threat actor group claims to have successfully breached the organization's networks and acquired sensitive information. This development follows a pattern often seen in modern cyberattacks where threat actors utilize leak sites to pressure victims by threatening the release of stolen information.

The claim was made on December 16, 2025. According to the announcement, the group alleges they have gained unauthorized access to the internal systems of the healthcare provider. However, it is important to note that the group has not disclosed any specific details regarding the volume of data stolen or the total file count involved in this alleged incident. Furthermore, the group has not issued a specific ransom demand in the public announcement provided to the leak site.

Details of the alleged data exfiltration

While the announcement explicitly mentions the exfiltration of personal data, the specific nature and scope of the compromised information remain unknown. The threat actors did not provide any screenshots or samples of the stolen files to substantiate their claims. Without such evidence, the exact contents of the breach cannot be verified.

The listing identifies the following as being affected by the incident:

• Personal data

In many ransomware scenarios, such as those involving double extortion, attackers first infiltrate a network to steal sensitive data and then deploy encryption to disrupt operations. The threat of leaking the stolen data serves as a secondary layer of leverage to compel the victim to pay a ransom. Even when encryption is not the primary focus, the theft of data remains a critical risk for organizations handling sensitive information.

About Markham Stouffville Hospital

Markham Stouffville Hospital, which operates under the Oak Valley Health umbrella, is a community hospital located in Ontario. The facility serves the Markham and Stouffville regions and provides a wide array of essential medical services. These services include emergency care, surgical procedures, childbirth services, and diagnostic imaging.

Potential risks and organizational implications

This incident may pose significant risks to the privacy of both patient and employee data held by the organization. Because the stolen information could potentially be utilized for identity theft or targeted phishing campaigns, the impact of such a breach can extend far beyond the initial network intrusion. The sensitive nature of healthcare data makes it a high-value target for cybercriminals.

Under Canadian PIPEDA regulations, a breach involving health-related data may trigger specific legal obligations for the institution. Organizations in this sector must often navigate complex regulatory frameworks when personal information is compromised. While information regarding the Anubis group is limited in the public domain, the potential for misuse of data remains a primary concern for healthcare providers.

To mitigate such risks, organizations typically need to review their data security protocols and may be required to notify all affected parties. Common defensive measures in the healthcare sector include implementing robust access controls, maintaining rigorous monitoring of network traffic, and ensuring that data encryption is applied to sensitive information both at rest and in transit. Addressing these vulnerabilities is essential for maintaining the trust of patients and employees alike.