Tri-Cities Gastroenterology listed on insomnia ransomware leak site

• Ransomware group: insomnia
• Country: United States
• Sector: Healthcare
• Announcement date: February 7, 2026

Tri-Cities Gastroenterology listed on insomnia leak site

The ransomware group known as insomnia has listed Tri-Cities Gastroenterology on its dedicated leak site. According to the announcement made on February 7, 2026, the group claims to have compromised the organization's data and has made these files available for public access.

Details of the claimed security incident

The announcement from the insomnia group indicates that the organization allegedly experienced a security incident on December 16, 2025. In such cyberattacks, ransomware groups often employ a tactic known as double extortion. In this scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The group then uses the threat of leaking this stolen information on their public leak site to pressure the victim into paying a ransom.

By publishing the victim's name on their platform, the group aims to maximize public pressure and reputational damage. In this specific case, the group claims to have successfully accessed and stolen data belonging to the healthcare provider, subsequently posting it to their site to demonstrate the success of their operation.

Data types and information involved

Based on the information provided in the leak site announcement, the group has shared screenshots that reveal the nature of the stolen information. The documentation appears to include various sensitive files that could compromise the privacy of individuals associated with the organization.

The leaked content reportedly includes:

• Patient medical records
• Tax identification information
• Personally identifiable information

The specific contents observed in the provided screenshots include W-9 tax forms, patient discharge instructions, medical transcription reports, and various documents containing personal patient information. No information was provided regarding the total size of the data stolen or the specific number of files involved in the breach. Additionally, no ransom demand has been specified in the public announcement.

About Tri-Cities Gastroenterology

Tri-Cities Gastroenterology is a healthcare provider specializing in digestive health, offering patient-centered, holistic care. The organization focuses on patient comfort while providing timely and reliable medical reports for referring physicians.

Risk assessment and industry implications

This incident may pose a high risk due to the exposure of sensitive patient medical data and financial information. As a healthcare provider operating in the United States, the situation may lead to legal repercussions under HIPAA regulations. The leaked data could potentially facilitate identity theft and targeted phishing attacks against patients and employees. Furthermore, negative impacts on the organization's reputation may be observed.

For organizations operating within the healthcare sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting sensitive data requires a multi-layered defense strategy, including regular security audits, employee training to recognize phishing attempts, and the implementation of strong access controls to limit the exposure of medical records. Because the information regarding the insomnia group is limited in the public domain, organizations must remain vigilant against the evolving tactics used by such threat actors.

General defensive measures for healthcare providers

To mitigate the risks associated with ransomware and data exfiltration, healthcare organizations often implement several defensive layers. This includes maintaining offline backups to ensure data availability and employing encryption for data at rest and in transit to protect patient privacy. Furthermore, monitoring network traffic for unusual patterns can help in the early detection of unauthorized data movement, potentially stopping a breach before data is successfully exfiltrated to an external server.