Columbia Medical Practice Hit by Qilin Ransomware Attack, Exposing Sensitive Data of 3,000 Patients Columbia Medical Practice, a multi-specialty healthcare provider based in Howard County, Maryland, suffered a ransomware attack on November 5, 2025, orchestrated by the Qilin ransomware group. The attackers infiltrated the organization’s network, encrypted files, and exfiltrated sensitive patient data before publicly claiming responsibility on the dark web on November 24, 2025. The breach was officially reported to the U.S. Department of Health and Human Services (HHS) on December 5, 2025, affecting approximately 3,000 individuals. Exposed information included personally identifiable data (names, addresses, Social Security numbers, driver’s license and passport details), health records (diagnoses, treatment history, prescription details, and physician assignments), and financial and insurance data (account numbers, insurance IDs, and payment information). Columbia Medical Practice, which operates under a Patient-Centered Medical Home (PCMH) model, has established a toll-free assistance line (1-833-974-3375) for affected individuals. The law firm Shamis & Gentile P.A. is investigating potential legal claims for those impacted, citing possible compensation for damages such as identity theft or financial losses. The incident underscores the growing threat of ransomware attacks targeting healthcare providers and the exposure of highly sensitive patient data.

A cyberattack in June on Columbia University allowed hackers to access the sensitive personal information of more than 860,000 people. The breach exposed Social Security numbers, college application data, academic history, financial aid information, health insurance details, and more. The incident disrupted IT systems, causing outages and preventing students from accessing emails and assignment platforms. The hackers, identified as politically motivated, targeted student data to further their agenda. The stolen data was shared with major news outlets, leading to controversial reports. The university offered affected individuals two years of free credit monitoring services.