River City Eye listed on Genesis ransomware leak site

• Ransomware group: Genesis
• Country: United States
• Sector: Healthcare
• Announcement date: October 21, 2025

Genesis claims to have stolen data from River City Eye

The ransomware group known as Genesis has listed River City Eye on its leak site, claiming to possess a significant amount of stolen data. According to the announcement published on October 21, 2025, the group alleges that the breach occurred around September 25, 2025. The group claims to have successfully compromised the organization's systems and has made a large volume of data available for download on their platform.

The Genesis group has published an announcement claiming to have compromised data belonging to River City Eye. The group alleges that 200 GB of data, reportedly obtained from company servers, has been made available for download. While the group has made these claims on their leak site, information regarding this group remains limited in the public domain.

Details of the alleged data breach

The announcement indicates the presence of various sensitive files obtained from the company's infrastructure. Specifically, the group claims that the stolen information was taken from company management hosts. The data size reported by the attackers is 200 GB, though the specific file count has not been disclosed. No ransom demand has been made public in the current announcement.

The content of the alleged leak includes several categories of sensitive information. The group claims that the following types of data are involved in the breach:

• Medical records
• Medical data
• Management data

The presence of such diverse data types suggests that the attackers targeted both clinical and administrative aspects of the organization's digital environment.

About River City Eye

River City Eye is an optometry clinic providing eye care services in the Hollywood and Happy Valley districts of Portland, Oregon. As a healthcare provider operating in the United States, the organization serves patients within these specific local communities in the Oregon region.

Potential implications and industry context

The alleged leak may pose significant risks to patient privacy and data security. The exposure of personal health information could potentially facilitate identity theft and targeted phishing attacks against the individuals involved. Furthermore, the incident may impact the organization's operational continuity and reputation. The use of double extortion tactics—where attackers both encrypt data and threaten to leak it—may be intended to increase pressure on the victim.

As a healthcare provider operating in the US, the incident may lead to legal scrutiny and regulatory penalties under HIPAA compliance if the claims are verified. In the healthcare sector, the protection of sensitive medical information is a critical priority due to the sensitive nature of patient records.

To defend against such threats, organizations in the healthcare sector often implement various security measures. These include robust access controls, encryption of data at rest and in transit, and continuous monitoring of network activities to detect unauthorized access. Regular security audits and employee training regarding phishing awareness are also common defensive steps used to mitigate the risk of initial compromise and subsequent data exfiltration.