RansomHub ransomware group lists www.okddsi.net on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Healthcare
• Announcement date: February 20, 2025

RansomHub claims access to Digestive Disease Specialists, Inc. data

The threat actor known as RansomHub has officially listed Digestive Disease Specialists, Inc. (www.okddsi.net) on its dedicated leak site. This announcement, which surfaced on February 20, 2025, indicates that the group claims to have successfully obtained access to the organization's internal data. The claim is currently supported by information extracted from the organization's own website, which serves as a basis for the group's identification of the target.

Ransomware leak sites are a central component of modern cyber extortion strategies. In these scenarios, threat actors often employ a method known as double extortion. This involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive data to use as leverage. By threatening to publish stolen information on a public platform, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential records.

Details of the alleged breach

The specific nature and volume of the data involved in this incident remain undisclosed by the RansomHub group. While the group has confirmed their claim of access, they have not provided details regarding the exact file count or the total size of the data allegedly stolen. Furthermore, the group has not issued a specific ransom demand in relation to this listing.

The listing provides very limited information regarding the content of the breach. Based on the available screenshots provided by the group, the information currently visible pertains to the organization's field of activity and its general contact details. The listing names no specific data types that have been exfiltrated.

The target organization

The organization targeted in this incident is Digestive Disease Specialists, Inc., which operates under the domain okddsi.net. The entity is based in the United States and operates within the healthcare sector.

Risk assessment and industry implications

The alleged leak poses significant risks, particularly due to the organization's position within the healthcare sector. In the medical field, the privacy of patient information is of paramount importance. If the claims made by RansomHub are accurate, the potential publication of sensitive data could lead to severe consequences for the individuals involved, such as identity theft or the deployment of highly targeted phishing attacks against patients.

Because the organization is based in the United States, this incident may trigger legal processes and regulatory scrutiny under the Health Insurance Portability and Accountability Act (HIPAA) regulations. Such frameworks are designed to ensure the protection of sensitive patient health information and mandate specific protocols when breaches occur.

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group that first emerged in early 2024. The group reportedly gained prominence by attracting affiliates from the ALPHV group. Although reports suggested that their operations had ceased in early 2025, the current activity suggests that the group may still be utilizing its established operational methods to conduct attacks.

For organizations operating in the healthcare sector, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize social engineering attempts. Additionally, maintaining offline, encrypted backups and implementing strict network segmentation can help mitigate the impact of such intrusions. As ransomware groups continue to evolve their tactics, healthcare providers remain a high-priority target for cybercriminals seeking valuable personal information.