Metro Tulsa Foot listed on insomnia ransomware leak site

• Ransomware group: insomnia
• Country: United States
• Sector: Healthcare
• Announcement date: August 31, 2026

The healthcare organization Metro Tulsa Foot has been listed on the leak site of the ransomware group known as insomnia. The group claims to have gained unauthorized access to the institution's network, marking a potential data breach involving sensitive medical and personal information.

The alleged attack and claims by insomnia

According to the announcement made on the insomnia leak site on August 31, 2026, the group claims to have successfully infiltrated the network of Metro Tulsa Foot. The group alleges that the initial access to the organization's systems occurred on August 3, 2026. While the specific methods used to breach the perimeter remain unknown, the presence of the organization on a dedicated leak site is a common tactic used by modern cybercriminals.

Information regarding the specific identity and operational details of the insomnia group remains limited. In many such instances, ransomware groups utilize leak sites to exert maximum pressure on their targets. By publishing or threatening to publish stolen data, these actors attempt to coerce organizations into meeting their demands. This approach is often referred to as a double-extortion strategy, where the threat of public exposure is used as leverage alongside the encryption of systems.

Data involved in the alleged leak

The listing provided by the group suggests that various types of sensitive information may have been compromised. Based on the information available from the leak site, the following data types are allegedly involved in the breach:

• Identity information
• Healthcare service documents

Visual evidence provided in the form of screenshots indicates that the leaked content includes documents related to the organization's internal operations. Furthermore, the group has shared examples of identification cards, which significantly elevates the sensitivity of the breach. No specific information was provided regarding the total size of the data stolen or the exact number of files taken. Additionally, no ransom demand has been publicly disclosed by the group in relation to this specific incident.

About Metro Tulsa Foot

Metro Tulsa Foot is a comprehensive foot and ankle treatment center that serves the Tulsa area. The institution operates through five different locations to provide specialized medical services. Their clinical focus includes treating foot pain, various deformities, and injuries. To accommodate urgent medical needs, the center offers same-day appointments for its patients.

Impact and industry implications

The alleged leak of such data can have significant negative impacts on the organization's patient privacy and its overall data security processes. For a healthcare provider, the exposure of medical documents and identity cards presents a high risk to the individuals involved. The presence of identification cards in the leaked datasets increases the vulnerability of patients to identity theft and targeted phishing attacks, as malicious actors can use these details to impersonate victims.

From a regulatory perspective, healthcare organizations in the United States may face significant obligations under the Health Insurance Portability and Accountability Act (HIPAA). Such regulations often require organizations to undergo formal data breach notification processes if protected health information is compromised. The organization may be required to notify all affected parties and implement rigorous security measures to mitigate secondary risks arising from the leak.

In the broader context of cybersecurity, this incident highlights the ongoing risks faced by the healthcare sector. Organizations in this field often manage highly sensitive data that is valuable on the dark web. To defend against such threats, it is common for institutions to implement multi-layered security frameworks, enhance monitoring of network access, and conduct regular audits of their data handling procedures. The use of double-extortion tactics by groups like insomnia demonstrates the evolving nature of ransomware, where the threat of data disclosure is used to bypass traditional backup and recovery defenses.