Medusa ransomware group claims data breach against Insightin Health

• Ransomware group: Medusa
• Country: United States
• Sector: Healthcare
• Announcement date: October 4, 2025

Medusa ransomware group claims data breach against Insightin Health

The Medusa ransomware group has announced a significant data breach involving Insightin Health, a company operating within the healthcare technology sector. According to a post made on the group's dedicated leak site, the threat actors claim to have exfiltrated a substantial volume of data belonging to the organization. This announcement follows a pattern of activity observed from the group, which utilizes its own platform to pressure victims through public exposure threats.

Details of the alleged attack and ransom demand

According to the claims made by the Medusa group, the incident that led to the data theft occurred on September 26, 2025. The group announced the breach on their leak site on October 4, 2025. In the announcement, the attackers have demanded a ransom payment of 500,000 USD. This payment is requested by the group in exchange for a promise not to publish the alleged stolen information on their platform.

The Medusa group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since 2021. They are known for employing double extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage. In such scenarios, the threat actors threaten to leak the stolen information publicly if the ransom is not met, creating a secondary layer of pressure on the victim organization.

Data involved in the claim

The group has provided specific metrics regarding the volume of the data they claim to have acquired, though they have not provided a specific breakdown of the files. The details provided by the group include:

• Total claimed data size: 378 GB

The listing does not provide specific details regarding the content or the specific types of files contained within the 378 GB dataset.

About Insightin Health

Insightin Health is a software company that specializes in the healthcare sector. The company provides an AI-powered platform known as inGAGE, which is designed to help healthcare payers eliminate data silos and deliver consumer-centric experiences. By analyzing healthcare data, the company develops solutions aimed at improving operational efficiency and increasing member satisfaction for its clients.

Analysis and potential implications

The alleged breach of Insightin Health carries several significant implications due to the nature of the company's business and the sector in which it operates. Because the company processes sensitive healthcare information, a breach of this magnitude could lead to complex compliance issues under strict regulatory frameworks, such as HIPAA.

The potential exposure of such a large dataset poses secondary risks to various stakeholders. For employees and service recipients, the theft of data can lead to risks such as identity theft or the execution of highly targeted phishing attacks. Furthermore, because Insightin Health provides services through a SaaS platform, a breach of this nature may impact the overall supply chain security for the various organizations that rely on their software solutions.

Given the history and past activities of the Medusa group, there is a high probability that the data will be released publicly if the ransom demand is not met. For organizations in the healthcare and software sectors, maintaining robust defensive measures is critical. Common defensive steps to mitigate these risks include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data exfiltration, and ensuring regular, offline backups of critical data. Additionally, managing supply chain risks through rigorous third-party security assessments is a vital component of modern cybersecurity posture.