MedStar Health Hit by RHYSIDA Ransomware Attack, Exposing Sensitive Patient Data MedStar Health, the largest healthcare provider in Maryland and the Washington, D.C. region, disclosed a significant data breach involving the RHYSIDA ransomware group. The incident, detected on October 4, 2025, occurred between September 12 and 16, 2025, when unauthorized actors accessed systems containing patient information. The nonprofit healthcare network—operating 10 hospitals, 300+ care locations, and employing 35,000+ staff, including 4,000 physicians—reported that exposed data included names, Social Security numbers, dates of birth, medical diagnoses, test results, insurance details, and treatment records. The RHYSIDA group claimed responsibility, threatening to leak the stolen data on the dark web. MedStar Health secured its systems, engaged third-party forensic experts, and notified law enforcement. By November 12, 2025, the organization confirmed the breach’s scope and began mailing notifications to affected patients on December 3, 2025. The incident underscores the growing threat of ransomware attacks on healthcare providers, where sensitive patient data remains a prime target for cybercriminals. MedStar Health, which serves over six million outpatient visits annually, is now facing potential legal action as affected individuals explore compensation for damages.

When cyberattacks strike global giants, it’s front-page news. But what about the smaller breaches -- the ones that don’t make headlines? Increasingly, they’re making waves in courtrooms and regulatory enforcement agencies. Even if an organization manages significantly less data than an enterprise-level company, recent cases involving small- to mid-sized businesses show that no breach is too minor for major legal risks. Fortunately, there are practical steps that organizations of all sizes can take to strengthen their cybersecurity posture and reduce their legal exposure. Small incidents can have “mega” consequences A few years ago, smaller cyber attacks might have gone without legal action. That is no longer the case. Today, even small incidents can result in lawsuits and regulatory inquiries. One example is MedStar Health. In 2023, a breach affecting 183,000 individuals -- small by industry standards -- led to six class action lawsuits that were consolidated in a single settlement. The breach stemmed from unauthorized access to employee email accounts. In other words, it was not a sophisticated hack. More recently, plaintiffs’ attorney websites have been found to be soliciting class participants in matters publicly disclosing that fewer than 1,000 individuals were affected. In addition to victims (or plaintiffs’ lawyers) who are more likely to be aware of breaches and to sue, regulatory enforcement agencies are more active, and breach-notification laws are expanding. At

MedStar Health, a healthcare provider, had faced ransomware attack which targeted some of its computer servers. The compromised data included name, address, date of birth, and for a limited number of individuals, Social Security number, some critical files. FBI investigated the incident and took down all system interfaces to prevent the virus from spreading throughout the organization. They paid thousands of dollars to extortionists for the safe recovery of encrypted data.