Metropolitan Community Health Services listed on Insomnia ransomware leak site

• Ransomware group: Insomnia
• Country: United States
• Sector: Healthcare
• Announcement date: September 14, 2026

Metropolitan Community Health Services targeted by Insomnia

Metropolitan Community Health Services is alleged to have had its data compromised after being listed on the leak site of the threat actor known as Insomnia. The threat actor claims to have gained unauthorized access to the entity's systems and acquired various documents. This announcement, which appeared on the group's leak site on September 14, 2026, follows a claimed attack date of August 24, 2026.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of releasing this stolen information on a public platform serves as a powerful lever to coerce the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the presence of the organization on the leak site indicates that the group is actively using public exposure as a method of intimidation.

Claims made by the Insomnia group

The Insomnia group has listed Metropolitan Community Health Services on its leak site, claiming to have obtained sensitive data from the organization. The threat actor asserts that they gained unauthorized access to the entity's systems and acquired various documents. To substantiate their claims, the group has shared several document samples as part of their announcement.

The provided screenshots from the leak site display sensitive documents that suggest a significant breach of confidentiality. These samples are intended to prove that the group has successfully bypassed security measures and accessed the internal files of the healthcare provider.

Sensitive data identified in the leak

The information allegedly stolen by the Insomnia group includes a variety of highly sensitive documents. Based on the samples provided by the threat actor, the following types of data are reportedly involved:

• W-2 tax forms
• Medical records
• Medication prescriptions
• Patient authorization forms

The exposure of such specific documentation, ranging from financial tax forms to private medical records and prescriptions, indicates that the breach touches upon both employee and patient information. The presence of patient authorization forms further suggests that the privacy of individuals receiving care has been compromised.

About Metropolitan Community Health Services

Agape Health Services is a community health center operated by Metropolitan Community Health Services. It provides a wide range of essential services to the community, including primary care, dental services, pharmacy, behavioral health care, and various social support programs.

Potential impact and industry implications

This incident may pose a significant risk due to the potential exposure of sensitive patient and employee information. For a healthcare provider, the unauthorized disclosure of medical records and personal identifiers can lead to severe consequences. As a healthcare organization, Metropolitan Community Health Services could face regulatory scrutiny and potential fines under HIPAA compliance requirements due to the nature of the leaked data.

The leaked data might be exploited by malicious actors for identity theft or targeted phishing campaigns. When sensitive information like tax forms and medical prescriptions are available to criminals, they can craft highly convincing social engineering attacks against both the organization's staff and its patients. Such attacks can lead to further compromises within the network or direct financial fraud against individuals.

Information regarding this threat group is limited. In response to such incidents, it is possible that the organization will need to initiate data breach notification protocols and provide support to the affected individuals. Organizations in the healthcare sector typically focus on strengthening access controls, implementing robust encryption for data at rest and in transit, and conducting regular security awareness training to mitigate the risks of unauthorized access and subsequent data exfiltration.