Cedar Valley Services Hit by Qilin Ransomware Attack, Exposing Sensitive Data On February 13, 2026, Cedar Valley Services a Southern Minnesota-based nonprofit reported a ransomware attack to the U.S. Department of Health and Human Services (HHS). The breach, attributed to the Qilin ransomware group, was first disclosed by the threat actors on December 21, 2025, via the Tor network, where they claimed to have exfiltrated data from the organization. While Cedar Valley Services has not publicly specified the types of compromised data, nonprofits in its sector typically handle sensitive information, including personally identifiable information (PII) such as names, addresses, and Social Security numbers, as well as protected health information (PHI). The incident was listed on the HHS breach portal, confirming its ransomware origin and the number of affected individuals. Following the discovery, Cedar Valley Services notified federal authorities and launched an investigation. Though the organization has not detailed its containment efforts, standard responses in such cases include system isolation, collaboration with cybersecurity experts, and notifications to impacted parties. The breach underscores the risks of ransomware targeting healthcare-adjacent organizations, where the exposure of PII and PHI can lead to identity theft and medical fraud.