Columbia Medical Practice Hit by Qilin Ransomware Attack, Exposing Sensitive Data of 3,000 Patients Columbia Medical Practice, a multi-specialty healthcare provider based in Howard County, Maryland, suffered a ransomware attack on November 5, 2025, orchestrated by the Qilin ransomware group. The attackers infiltrated the organization’s network, encrypted files, and exfiltrated sensitive patient data before publicly claiming responsibility on the dark web on November 24, 2025. The breach was officially reported to the U.S. Department of Health and Human Services (HHS) on December 5, 2025, affecting approximately 3,000 individuals. Exposed information included personally identifiable data (names, addresses, Social Security numbers, driver’s license and passport details), health records (diagnoses, treatment history, prescription details, and physician assignments), and financial and insurance data (account numbers, insurance IDs, and payment information). Columbia Medical Practice, which operates under a Patient-Centered Medical Home (PCMH) model, has established a toll-free assistance line (1-833-974-3375) for affected individuals. The law firm Shamis & Gentile P.A. is investigating potential legal claims for those impacted, citing possible compensation for damages such as identity theft or financial losses. The incident underscores the growing threat of ransomware attacks targeting healthcare providers and the exposure of highly sensitive patient data.