Northeast Pediatrics & Adolescent Medicine targeted by Anubis ransomware group

• Ransomware group: Anubis
• Country: United States
• Sector: Healthcare
• Announcement date: July 2, 2026

Anubis ransomware group claims data breach at Northeast Pediatrics & Adolescent Medicine

The threat actor known as Anubis has published data allegedly belonging to Northeast Pediatrics & Adolescent Medicine on its leak site. According to the announcement, the group has listed various documents that it claims are the property of the medical institution. This development follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to exert pressure on their victims.

Details of the alleged leak

The Anubis group has listed various documents on its leak site that it claims belong to Northeast Pediatrics & Adolescent Medicine. The announcement states that personal data belonging to the clinic's employees and patients has been exposed. The group claims to have published this data on July 2, 2026, and suggests that it contains information regarding the institution's operational processes. While the group has made these claims, public information regarding the specific methods or background of this group remains limited.

Based on the information provided by the threat actor, the leaked content is highly sensitive. The screenshots provided by the group appear to display a wide range of private documentation. The specific types of data identified in the leak include:

• Patient records
• Driver's licenses
• Health insurance information
• Employee employment data
• Legal documents

The presence of such diverse documentation suggests a significant breach of administrative and clinical information systems.

About Northeast Pediatrics & Adolescent Medicine

Northeast Pediatrics & Adolescent Medicine is a pediatric clinic located in Ithaca, New York. The organization provides essential medical care services specifically tailored for children and adolescents within the community.

Risk assessment and industry implications

The nature of the allegedly leaked data may create a high risk of identity theft for the institution's employees and patients. Because the sensitive documents include identification such as driver's licenses and employment verification, the potential for fraudulent activity is significant. Furthermore, the sensitivity of the shared documents may increase the likelihood of affected individuals being subjected to targeted phishing attacks, as attackers often use stolen personal details to craft convincing fraudulent communications.

As the institution operates in the healthcare sector, this situation could lead to compliance issues under regulations such as HIPAA, which governs the protection of sensitive patient health information. The publication of the institution's operational documents could also pose secondary risks regarding supply chain security, as internal processes are exposed to malicious actors.

The group's publication of such data may be evaluated as part of a double-extortion tactic. In a double-extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal the data and threaten to release it publicly to maximize their leverage during ransom negotiations. This tactic is designed to cause significant reputational damage to the victim organization. To mitigate such risks, organizations in the healthcare sector typically focus on robust data encryption, strict access controls, and comprehensive employee training to prevent initial entry by threat actors.