NorthShore Health Centers

Summary

NorthShore Health Centers, a nonprofit healthcare provider in Northwest Indiana, detected suspicious network activity and launched an investigation with third-party cybersecurity and digital forensics experts. The investigation determined that an unauthorized third party accessed parts of its IT environment for approximately one day and potentially viewed or obtained files containing patient information, including names, Social Security numbers, medical treatment and condition details, and health insurance information. The ransomware group Insomnia claimed responsibility, added the organization to its dark web leak site, and leaked the stolen data after threatening to publish it unless a ransom was paid. Notification letters will be mailed to affected individuals once the ongoing data review is concluded.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

NorthShore Health Centers, a nonprofit healthcare provider serving patients in Porter, Lake, La Porte, and Jasper Counties in Northwest Indiana, disclosed a cybersecurity incident through a website notice published on October 14, 2026. The organization first detected suspicious network activity on August 10, 2026, and promptly launched an investigation into the event. Third-party cybersecurity and digital forensics experts assisted with the investigation to determine the scope and nature of the unauthorized access. The investigation determined that an unnamed unauthorized third party gained access to parts of the organization's IT environment between August 10, 2026, and August 11, 2026. During that window, the intruder potentially viewed or obtained files containing patient information. The investigation and data review remained ongoing as of the October 14 notice, meaning the total number of affected individuals had not yet been confirmed. Officials stated that the specific types of information involved were still under assessment. Based on the available evidence, it was likely that names, Social Security numbers, information related to medical treatments and conditions, and health insurance information were exposed. The organization serves current and former patients across its Northwest Indiana service area.

A ransomware group identified as Insomnia claimed responsibility for the incident against NorthShore Health Centers. The group added the organization to its dark web data leak site and threatened to publish the stolen data unless a ransom was paid. After issuing that threat, the group proceeded to leak the stolen data on its leak site. The HIPAA Journal reported that it had not downloaded any of the leaked data, though the file tree associated with the leak suggested that patient data was likely included in the dataset. NorthShore Health Centers stated that it would mail notification letters to affected individuals once the data review was concluded. The notification process would apply to both current and former patients whose information may have been compromised. The exposed information potentially included personal identifiers and protected health information spanning medical treatment records and insurance details. The organization continued working with external forensic partners to complete its review of the affected files and determine the full scope of the breach.

Sources

Sources available to members: 1 source.