Spindletop Center data allegedly leaked by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: United States
• Sector: Healthcare
• Announcement date: October 30, 2025

Rhysida claims to have leaked Spindletop Center data

The Rhysida ransomware group has officially listed data allegedly belonging to the Spindletop Center on its dedicated leak site. This announcement, made on October 30, 2025, marks a significant escalation in the ongoing threat landscape facing healthcare providers. The group claims to have successfully breached the organization's systems, an incident that was reportedly discovered on the same day the announcement was made.

According to the claims made by the threat actor, the breach involves data related to the organization's essential healthcare services and its various social support programs. This type of activity is characteristic of modern ransomware operations, where attackers target sensitive information to maximize leverage during negotiations.

Details of the claimed data breach

While the group has not provided any screenshots to verify their claims, the information released suggests a massive scale of data exposure. The group alleges that the stolen data includes over 100,000 patient records. This volume of data represents a significant amount of highly sensitive information that could be exploited for various malicious purposes.

The specific types of information reportedly contained within the compromised records include:

• Patient address information
• Phone numbers
• Passport numbers
• Social security numbers
• Diagnosis information
• Medical history

The presence of such diverse and sensitive identifiers, ranging from contact details to highly private medical diagnoses, highlights the potential severity of the incident if these claims are verified. No information was provided regarding the specific size of the data or the ransom demand associated with this attack.

About Spindletop Center

Spindletop Center is a non-profit healthcare organization based in Texas. The organization plays a vital role in the community by providing a wide range of essential services. Their mission includes providing behavioral healthcare and specialized programs designed for individuals with intellectual and developmental disabilities. Additionally, the center offers various services focused on substance use recovery, making them a critical component of the regional healthcare and social support infrastructure.

Implications and industry risks

If the claims made by the Rhysida group are proven to be accurate, the leak of this data could significantly increase the risk for patients. Specifically, the exposure of social security numbers, passport numbers, and medical histories could make individuals highly vulnerable to identity theft and targeted phishing attacks. Such attacks often use stolen personal details to gain further access to victim accounts or to conduct sophisticated social engineering scams.

The sensitivity of health data means that incidents like this can lead to serious consequences. For healthcare organizations, such breaches may result in legal and administrative sanctions under strict regulatory frameworks, such as the Health Insurance Portability and Accountability Act (HIPAA). Furthermore, the use of the double-extortion method—where attackers not only encrypt data but also threaten to leak it—is a tactic used by groups like Rhysida to exert maximum pressure on an organization to pay a ransom.

Beyond the immediate digital threat, organizations in this sector may face operational disruptions and a potential decline in patient trust. To defend against such threats, organizations typically focus on robust security measures, including regular system audits, employee training to recognize phishing, and implementing strict access controls. While public information regarding the specific capabilities and history of the Rhysida group remains limited, their ability to target healthcare providers highlights the ongoing necessity for heightened cybersecurity vigilance in the medical sector.