Southwest Care Center Hit by MEDUSA Ransomware Attack, Exposing Sensitive Patient Data Southwest Care Center, a New Mexico-based nonprofit healthcare provider serving communities since 1996, disclosed a ransomware attack that compromised sensitive patient data. The incident, detected on June 3, 2025, was claimed by the MEDUSA ransomware group, which threatened to publish 143.9 GB of stolen data on the dark web. The breach was publicly acknowledged on June 27, 2025, when the group posted details on the Tor network. After discovering the attack, Southwest Care Center engaged forensic specialists to secure its systems and assess the breach. By December 18, 2025, the investigation confirmed that unauthorized access may have exposed personally identifiable information (PII) and protected health information (PHI), including first and last names, personal details, and medical records. Affected individuals were notified via written letters, and a public notice was posted on the organization’s website. Southwest Care Center operates multiple clinics in Santa Fe and Albuquerque, providing HIV/AIDS care, primary care, behavioral health, and pharmacy services to a diverse patient population. The law firm Shamis & Gentile P.A. is investigating the breach for potential legal action on behalf of impacted individuals.

Southwest Care Center Hit by MEDUSA Ransomware Attack, Exposing Sensitive Patient Data On June 3, 2025, Southwest Care Center, a nonprofit healthcare provider in New Mexico, detected a cybersecurity incident that prompted an immediate response. The organization engaged third-party forensic experts to secure its systems and assess the scope of unauthorized access. By June 27, 2025, the MEDUSA ransomware group claimed responsibility, posting on the dark web that it had exfiltrated 143.9 GB of data from the organization. The group threatened to publish the stolen information within 11 to 12 days unless demands were met. An investigation concluded on December 18, 2025, revealing that the breach may have exposed sensitive personal and protected health information (PHI), including names and other personally identifiable data. Southwest Care Center published a notice of the incident on its website and began notifying affected individuals. In response, the organization is offering 12 months of complimentary credit monitoring and identity theft protection services to those impacted. A dedicated call center has been established for further inquiries. The incident underscores the ongoing threat ransomware groups pose to healthcare providers and the potential risks to patient privacy.

Christus Health and Southwest Care Center Alert New Mexico Patients to Separate Data Security Incidents In January 2025, an unauthorized user accessed sensitive patient data through a breach at Oracle Health (formerly Cerner Corp.), a laboratory information software vendor used by Christus Health. The exposed information spanning records predating February 2025 includes names, Social Security numbers, lab orders, blood bank records, diagnoses, medications, and test results. While Christus Health’s systems remained unaffected, the organization is collaborating with Oracle to identify and notify impacted individuals. Separately, Southwest Care Center, which operates clinics in Santa Fe and Albuquerque, disclosed a June 2025 cybersecurity incident where an unauthorized party may have acquired patient data. The center has since strengthened its technical safeguards but has not found evidence of data misuse. However, affected patients have filed a class-action lawsuit in Santa Fe’s First Judicial District Court, alleging negligence in protecting their information and increased risks of identity theft. Both incidents reflect the growing threat of third-party vendor breaches in healthcare, a trend highlighted by the FBI’s 2024 cybercrime reports. Christus Health and Southwest Care Center are working with regulators to address the fallout, though litigation remains pending. The breaches underscore vulnerabilities in interconnected healthcare systems and the challenges providers face in securing patient data.