Woodglen Medical Group targeted by Anubis ransomware group

• Ransomware group: Anubis
• Country: United States
• Sector: Healthcare
• Announcement date: December 23, 2025

Anubis claims to have leaked Woodglen Medical Group data

The threat actor group known as Anubis has published an announcement on their leak site claiming to have targeted Woodglen Medical Group. According to the group's claims, they have obtained and released sensitive information belonging to the healthcare provider. This incident involves the publication of what the group alleges to be patient medical records and photographs belonging to the organization.

Ransomware groups often utilize leak sites to host stolen data as a method of double extortion. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also threaten to release sensitive information to the public to pressure the victim into paying a ransom. While the specific details regarding the ransom demand or the exact volume of data stolen were not provided in the announcement, the threat actor has moved forward with publicizing the alleged breach.

Details of the claimed attack

The Anubis group published their announcement on December 23, 2025, claiming that the attack against Woodglen Medical Group occurred on the same day. The threat actor released various medical documents and patient photographs that are alleged to have been obtained from the institution's systems. Information regarding the specific identity and operational details of the Anubis group remains limited in the public domain.

The disclosure of such data typically follows a period of unauthorized access where attackers navigate through internal networks to identify high-value information. In the healthcare sector, this often includes highly sensitive personal and medical data that is highly sought after on the dark web due to its value for fraudulent activities.

Data allegedly involved in the leak

The information shared on the leak site includes a variety of sensitive documents and visual media. The items allegedly released by the group include:

• Patient medical records
• Patient photographs
• Personal identification information

Specifically, the images shared on the leak site include patient medical examination forms, personal identification information, and pre- and post-operative aesthetic surgery photographs. The exposure of these specific types of data, particularly surgical photographs, represents a significant breach of individual privacy.

Implications and industry considerations

This leak may have negative impacts on patient privacy. As the institution is a US-based healthcare provider, this incident may trigger legal processes under HIPAA regulations. The exposure of sensitive data could increase the risk of patients being subjected to identity theft or targeted phishing attacks. Furthermore, the disclosure of this data may highlight the importance of data security standards within the healthcare sector.

The impact of such a breach extends beyond immediate privacy concerns. It is possible that the institution may face reputational damage and a loss of trust from its patients. When sensitive medical imagery and personal identifiers are made public, the damage to the relationship between a healthcare provider and its clientele can be long-lasting.

For organizations operating within the healthcare sector, such incidents underscore the necessity of robust cybersecurity frameworks. Defensive measures often include implementing strict access controls, continuous monitoring of network traffic, and comprehensive encryption for data at rest and in transit. Maintaining compliance with regulatory standards is essential not only for legal protection but also for preserving the fundamental trust that patients place in medical institutions to protect their most private information.