Sermo Reports Data Breach Following Ransomware Attack in Denmark Sermo, a healthcare-focused platform, disclosed a data breach after a ransomware attack disrupted operations at its Denmark-based data center. The incident began on April 10, 2024, when a power outage was later identified as a ransomware event, prompting an internal investigation. The company confirmed that an unauthorized third party may have accessed and exfiltrated sensitive personal data between March 19 and April 10, 2024. Exposed information includes names and Social Security numbers, though the exact details vary by individual. On February 9, 2026, Sermo began notifying affected individuals via mail, providing specifics on the compromised data and offering complimentary credit monitoring services. The breach notice was filed with the Attorney General of Maine, where details of the incident are publicly available.

Sermo Data Breach Exposes 2,674 Individuals to SSN Leak in March 2024 Ransomware Attack Sermo, a social network for physicians, confirmed a March 2024 data breach affecting 2,674 individuals after their Social Security numbers were exposed. The ransomware group Black Basta claimed responsibility for the attack in April 2024, alleging it stole 700 GB of data from the company. A second group, Medusa, later asserted it had also breached Sermo in July 2025, demanding a $500,000 ransom though Sermo did not acknowledge this claim. According to Sermo’s breach notice, the incident began with a power outage at its Denmark data center on April 10, 2024, later identified as a ransomware attack. Unauthorized access occurred between March 19 and April 10, 2024, with Black Basta posting stolen data on its leak site on April 17, 2024. Delays in disclosure were attributed to difficulties retrieving the data, as Black Basta’s site was slow and unstable Sermo only completed the download in September 2024 after months of failed attempts. The group’s leak site was taken down on January 27, 2025, removing public access to the stolen data. As a response, Sermo is offering affected individuals 12 months of free credit monitoring and identity theft restoration through Kroll. Black Basta, a ransomware-as-a-service (RaaS) operation active since early 2022, was known for double extortion demanding payment both to decrypt systems and to prevent data leaks. The group was disrupted by law enforcement in 2025, though some of its breaches, like Sermo’s, are only now coming to light. Prior to its shutdown, Black Basta claimed 173 confirmed attacks since 2022, exposing nearly 12 million people’s data. Other major healthcare-related breaches included Ascension (5.6 million affected) and Numotion (700,000 affected). The incident reflects broader risks in the healthcare sector, where ransomware attacks can disrupt critical systems and expose sensitive patient data. In 2024, researchers tracked 32 confirmed ransomware attacks on healthcare-related businesses, compromising over 196 million records. While 2025 saw fewer incidents (27 attacks), they still exposed 5.9 million individuals’ data. Recent examples include MedRevenu (December 2024, BianLian) and MTI America (September 2025, Sinobi). Sermo, which serves over 1 million verified physicians, facilitates medical discussions, drug ratings, and paid surveys. The breach underscores the persistent threat ransomware poses to healthcare infrastructure and patient privacy.