Southern Illinois Dermatology listed on insomnia leak site

• Ransomware group: insomnia
• Country: United States
• Sector: Healthcare
• Announcement date: February 7, 2026

Insomnia group claims data breach at Southern Illinois Dermatology

The threat actor group known as insomnia has listed Southern Illinois Dermatology on its leak site, claiming to have obtained sensitive patient data. According to the group's announcement, the breach involves a massive volume of information, with the group alleging that over 150,000 patient records have been compromised during the incident.

The claim suggests that the threat actors successfully gained access to the organization's network. To support their allegations, the group has published various documents as evidence of the alleged breach. This method of publishing evidence is a common tactic used by ransomware groups to pressure victims into paying ransoms, a technique often referred to as double extortion, where data is both encrypted and stolen for potential public release.

Details of the alleged data theft

The data claimed to be leaked by the insomnia group is highly sensitive, encompassing a wide range of personal and medical information. The group alleges that the stolen datasets include various identifiers that could be used for malicious purposes, such as identity theft or targeted phishing campaigns. The specific types of information mentioned in the listing include:

• Patient names
• Social Security Numbers (SSN)
• Dates of birth
• Medical record numbers
• Clinical information
• Health insurance details
• Prescriptions
• Treatment information
• Email usernames

About Southern Illinois Dermatology

Southern Illinois Dermatology is a healthcare provider founded in 1996. The organization offers a variety of services, including general, surgical, and cosmetic dermatology, as well as advanced laser treatments. The provider maintains a significant presence in its service area, operating across 15 different locations to provide professional dermatological care.

Risk assessment and industry implications

This incident may pose a high risk due to the exposure of sensitive personal health information. For an organization operating in the United States, such a breach may lead to significant regulatory scrutiny and legal implications under HIPAA compliance frameworks. The exposure of such granular data, including Social Security Numbers and medical histories, creates a high potential for identity theft and highly targeted phishing attacks against the affected individuals.

Beyond the immediate privacy concerns, the organization may observe negative impacts on its operational continuity and the trust established with its patients. Furthermore, there are secondary risks to consider, such as the potential for the stolen data to be further disseminated by other threat actors or the possibility of the organization being subjected to ongoing double extortion tactics.

In the healthcare sector, such incidents highlight the critical importance of robust cybersecurity measures. Organizations in this sector typically focus on protecting Protected Health Information (PHI) through various defensive steps. These common industry practices include implementing multi-factor authentication (MFA), maintaining strict access controls to limit data exposure, and conducting regular network monitoring to detect unauthorized access. Additionally, maintaining offline backups and conducting regular incident response drills are essential components of a comprehensive security posture designed to mitigate the impact of ransomware and data exfiltration events.