Heartland Health Center, a Nebraska-based nonprofit and Federally Qualified Health Center (FQHC), suffered a ransomware attack by the MEDUSA group in February 2025. Unauthorized actors breached its network, exposing highly sensitive personal and medical data of patients and employees. The compromised information included Social Security numbers, driver’s license numbers, financial account details, full medical records (diagnoses, treatments, insurance data), Medicare/Medicaid numbers, and biometric identifiers like full-face photos. The breach was confirmed in June 2025, with notifications sent to affected individuals in October 2025. This incident followed a prior LockBit ransomware attack in May 2024, highlighting systemic vulnerabilities. The exposure of such comprehensive data poses severe risks of identity theft, financial fraud, medical fraud, and long-term reputational harm to the organization and its stakeholders. Heartland offered 12 months of credit monitoring, but the scale of the breach suggests potential legal liabilities and regulatory penalties.