Medusa ransomware group targets Southwest CARE Center

• Ransomware group: Medusa
• Country: United States
• Sector: Healthcare
• Announcement date: July 6, 2025

Medusa ransomware group targets Southwest CARE Center

The Medusa ransomware group has officially listed the Southwest CARE Center on its leak site, claiming to have compromised a significant amount of data belonging to the organization. According to the group's announcement, which was posted on July 6, 2025, the attackers claim to have gained access to the organization's networks around June 27, 2025. The threat actor is reportedly demanding a ransom of 200,000 dollars to prevent the further release of the stolen information.

Details of the alleged breach

The Medusa group has claimed that approximately 143.9 GB of data has been exfiltrated from the organization's systems. To support their claims of a successful intrusion, the group has shared information summarizing the operations and history of the Southwest CARE Center. This includes the publication of sample documents intended to prove the validity of their claims.

While the total volume of the data has been specified, the group has not provided detailed information regarding the full scope of the leaked data. The available screenshots and samples indicate that the compromised information includes various corporate documents. The specific types of data identified in the listing include:

• Financial documents
• Service agreements
• Budget tables

About Southwest CARE Center

Southwest CARE Center is a healthcare organization located in the United States that specializes in the treatment of HIV and Hepatitis C, as well as clinical research. Founded in 1996, the center provides patient-centered healthcare services at its facilities located in Santa Fe and Albuquerque, New Mexico.

Analysis and potential implications

This incident highlights the growing risks faced by healthcare providers. The leak may pose a significant risk to the organization's patient data and sensitive health records. Because the Southwest CARE Center is a US-based healthcare provider, this situation may trigger data breach notification obligations and legal processes under HIPAA regulations. Furthermore, given the organization's involvement in clinical research, the breach may have negative implications for supply chains and academic studies.

The Medusa group appears to be employing a double extortion method. In such scenarios, attackers do not just encrypt systems but also steal sensitive data, threatening to publish it online to pressure the victim into paying. This method can increase secondary risks for the victim organization, such as identity theft and targeted phishing attacks following the publication of the data.

For organizations operating in the healthcare sector, maintaining robust cybersecurity postures is essential to protect sensitive information. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff to recognize phishing attempts. Additionally, strict access controls and network segmentation can help limit the movement of attackers within a network once an initial breach has occurred.