RansomHub ransomware group lists www.elizajennings.org on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Healthcare
• Announcement date: March 21, 2025

RansomHub claims data breach at Eliza Jennings

The RansomHub ransomware group has officially listed the organization www.elizajennings.org on its dedicated leak site. According to the announcement made on March 21, 2025, the threat actor group claims to have successfully breached the systems of the organization and exfiltrated a significant amount of sensitive information.

This incident follows a common pattern observed in modern cyberattacks known as double extortion. In these scenarios, ransomware groups do not merely encrypt an organization's files to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on public forums or specialized leak sites, attackers aim to pressure the victim into paying a ransom to prevent the public exposure of confidential records.

The group alleges that they gained unauthorized access to the organization's internal systems and subsequently moved various documents out of the network. While the group has made these claims publicly, information regarding the specific technical methods or the full identity of the RansomHub group remains limited.

Details of the allegedly leaked data

The data allegedly stolen by the RansomHub group is substantial in volume and variety. The group claims to have obtained approximately 268 MB of data, which reportedly consists of 204,787 files. The contents of this data dump are diverse, spanning administrative, financial, and clinical documentation.

According to the claims made on the leak site, the stolen information includes:

• Patient health records
• Financial statements
• Contracts
• Contact information

Beyond these categories, the group specifically mentions that the leaked content contains patient care forms, academic consulting agreements, AT&T data breach notifications, and internal operational file directories. The inclusion of such varied documentation suggests a broad reach into the organization's digital environment.

About Eliza Jennings

Eliza Jennings is a non-profit organization based in Cleveland, Ohio. The institution provides a wide range of senior care and retirement services designed to support the elderly population. Their service portfolio includes various senior care solutions, such as nursing homes, assisted living facilities, and home health care services.

Potential impact and industry implications

The exposure of the alleged data carries significant risks for both the organization and the individuals whose information was compromised. Because the leaked data reportedly includes patient health records, the incident may pose a risk of data privacy violations under the Health Insurance Portability and Accountability Act (HIPAA) regulations in the United States. Such regulatory breaches often lead to complex legal proceedings and significant oversight.

Furthermore, the exposure of the organization's financial data could lead to disruptions in commercial operational processes. For the individuals affected, the theft of contact information and health records increases the risk of identity theft or targeted phishing attacks. These attacks often use stolen personal details to gain trust and trick victims into revealing even more sensitive information.

The impact of such a breach can extend beyond the primary target. Secondary risks to the organization's supply chain partners may be observed if the stolen data contains information regarding third-party vendors or contractors. Additionally, the activities of the RansomHub group could lead to lasting reputational damage for the organization.

In the healthcare sector, organizations typically focus on robust defensive measures to mitigate these risks. This includes implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movement, and ensuring that all sensitive data is encrypted both at rest and in transit. Regular security awareness training is also a common defensive step to help staff recognize the phishing attempts that often follow such data leaks.