Spindletop Center Hit by Rhysida Ransomware Attack in September 2025 In September 2025, Spindletop Center, a Texas-based behavioral health clinic, disclosed a data breach affecting an undisclosed number of patients. The incident, first detected on September 29, 2025, involved unauthorized access to sensitive information, including names, Social Security numbers, government-issued IDs, diagnoses, and case numbers. The ransomware group Rhysida claimed responsibility for the attack, asserting it stole records of 100,000 individuals and demanding a 15 bitcoin ransom (approximately $1.65 million). Rhysida provided sample documents as proof of the breach, though Spindletop has not verified the group’s claims. The clinic’s investigation, concluded on December 3, 2025, determined that unauthorized access may have occurred as early as September 23, 2025. Spindletop’s breach notification did not mention credit monitoring or identity theft protection for affected individuals. Rhysida, a ransomware-as-a-service (RaaS) operation active since May 2023, has been linked to 100 confirmed attacks (and 156 unconfirmed) since its emergence, compromising nearly 5.5 million records. The group’s average ransom demand is $1.17 million, with healthcare providers being frequent targets. In 2025 alone, Rhysida claimed 17 breaches, including four in the healthcare sector: - Florida Lung, Asthma & Sleep Specialists (May 2025, 10,000 affected, $639,000 ransom) - Cookeville Regional Medical Center (July 2025, 500+ affected, $1.15 million ransom) - MedStar Health (September 2025, $3.1 million ransom) The Spindletop breach is part of a broader surge in ransomware attacks on U.S. healthcare providers. In 2025, 104 confirmed incidents compromised over 8.8 million records, with an average ransom demand of $697,000. Other recent attacks include: - Pulse Urgent Care Center (March 2025, 4,035 affected, $120,000 ransom by Medusa) - Medical Center, LLP (Georgia) (October 2025, claimed by PEAR) - University of Hawaii Cancer Center (August 2025) Ransomware attacks on healthcare facilities disrupt critical systems, forcing providers to cancel appointments, divert patients, or revert to manual record-keeping. The fallout can jeopardize patient safety, privacy, and operational stability. Spindletop Center, headquartered in Beaumont, Texas, operates five locations and serves over 16,000 patients annually, employing more than 500 staff. The clinic offers mental health services, substance use treatment, and support for intellectual and developmental disabilities.

Pulse Urgent Care Center Hit by Medusa Ransomware Attack in March 2025 Pulse Urgent Care Center in Redding, California, disclosed a March 2025 data breach affecting an undisclosed number of patients. The incident exposed sensitive personal and medical information, including names, Social Security numbers, driver’s license numbers, health insurance details, and medical records. The ransomware gang Medusa claimed responsibility for the attack, posting alleged stolen documents as proof and demanding a $120,000 ransom. Pulse has not confirmed Medusa’s involvement or whether a ransom was paid. The clinic first detected suspicious network activity on March 24, 2025, and later confirmed potential data access on May 1, 2025. As part of its response, Pulse is offering 12 months of free credit monitoring and identity theft protection via TransUnion to eligible victims, with enrollment open until 90 days from the notice date (December 26, 2025). About Medusa Active since September 2019, Medusa operates a ransomware-as-a-service (RaaS) model, encrypting systems and exfiltrating data to extort victims. In 2025 alone, the group claimed 153 attacks, with 31 confirmed, compromising over 1.6 million records. Its average ransom demand is $563,000, and it has targeted 11 healthcare providers this year, including a January 2025 attack on SimonMed Imaging that exposed 1.3 million records. Broader Impact on U.S. Healthcare Ransomware attacks on healthcare providers remain a critical threat. In 2025, researchers recorded 92 confirmed attacks on U.S. hospitals and clinics, compromising 8.8 million records. Recent incidents include breaches at Richmond Behavioral Health Authority (113,232 records, September 2025), Covenant Health (478,188 records, May 2025), and Brevard Skin and Cancer Center (55,500 records, September 2025). Such attacks disrupt operations, force manual record-keeping, and risk patient safety by delaying care. Pulse Urgent Care Center, part of Docs Medical Group, operates two locations in Redding and Red Bluff, California, serving patients since 2010.