Valley Health Team data allegedly listed by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: United States
• Sector: Healthcare
• Announcement date: August 28, 2026

Rhysida ransomware group claims to have breached Valley Health Team

The Rhysida ransomware group has listed data allegedly belonging to Valley Health Team on their leak site. The group claims to have obtained a massive volume of information, totaling approximately 3.28 TB, which they assert represents the institution's entire lifetime of information.

The announcement, made on August 28, 2026, suggests a significant compromise of the organization's digital infrastructure. According to the claims made by the threat actors, the breach involves over 9 million files and large-scale SQL databases, indicating a deep penetration into the organization's data storage systems.

Details of the alleged data theft

The scale of the alleged theft is substantial, involving a vast array of sensitive information. The group claims to have access to a wide variety of documents and records that could pose significant risks if released. The following types of data are reportedly included in the leak:

• Patient health records
• Diagnoses
• Electronic health records (EHR)
• Passport details
• Social security numbers (SSN)
• Financial statements
• Salary details
• Tax records

In addition to these categories, the group has provided screenshots that appear to display various contract samples and patient data, further supporting their claims of having accessed highly sensitive internal and personal information.

About Valley Health Team

Valley Health Team is a healthcare organization operating a network of community health centers in California's Central Valley. The organization provides essential medical services to the region, including primary care, dental services, and behavioral health services.

Analysis and potential impact of the incident

This incident may pose a significant risk to the protection of sensitive data within the healthcare sector. The specific nature of the leaked data—which includes highly personal identifiers like social security numbers and passports alongside medical diagnoses—could increase the likelihood of patients being exposed to identity theft and targeted phishing attacks. When sensitive personal information is compromised, attackers often use it to craft highly convincing fraudulent communications to deceive individuals.

Furthermore, the institution may face legal sanctions under healthcare data protection regulations due to the sensitive nature of the compromised information. The group's use of the double extortion method is a common tactic in modern ransomware attacks. In a double extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal the data to threaten its public release, thereby increasing the pressure to pay the ransom.

The targeting of healthcare institutions by groups like Rhysida can have devastating impacts on operational continuity. For healthcare providers, the loss of access to electronic health records or the threat of leaking patient data can disrupt the delivery of critical medical services. To defend against such threats, organizations in this sector typically focus on robust defensive steps, such as implementing multi-factor authentication, maintaining offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized access early.