Insomnia Ransomware Group Claims Attack on NorthShore Health Centers; Indiana Nonprofit Warns Patients of PHI Exposure

A ransomware group has publicly claimed credit for attacking a nonprofit health system serving an entire corner of Indiana, and the full scope of that attack is still unknown.

NorthShore Health Centers, which provides care across four Northwest Indiana counties, has begun warning patients of a cybersecurity incident it first detected on August 10, 2026. The Insomnia ransomware group has since claimed responsibility for the attack. As of this writing, the number of individuals whose protected health information was exposed has not been confirmed, and the investigation remains active.

This is a breach notification event, not a regulatory enforcement action. No fine has been announced, and no OCR settlement is associated with this incident.

What Data Was at Risk

NorthShore Health Centers has indicated that the following categories of information may have been exposed:

• Full names
• Social Security numbers
• Medical treatment information
• Health insurance data

Each of these categories qualifies as protected health information under HIPAA's Privacy Rule. The combination of Social Security numbers with medical and insurance data creates layered risk for affected individuals, including identity theft and insurance fraud, in addition to the privacy harms HIPAA is designed to prevent.

The Ransomware Claim and What It Means for Notification Obligations

When a ransomware group publicly claims an attack, it complicates the question of whether a breach has occurred under HIPAA. OCR's 2016 ransomware guidance established that a ransomware infection generally constitutes a breach of unsecured PHI unless the covered entity can demonstrate a low probability that the data was compromised, using the four-factor risk assessment defined under the Breach Notification Rule.

That four-factor assessment covers: the nature and extent of the PHI involved, who accessed or could have accessed it, whether the PHI was actually acquired or viewed, and the extent to which risk has been mitigated. A public claim by a known ransomware group makes it significantly harder to establish a low probability of compromise.

Covered entities must provide individual notification without unreasonable delay and no later than 60 days following discovery of a breach.

If the affected individual count reaches 500 or more in any state, NorthShore Health Centers would also be required to notify prominent media outlets in that state and submit notice to HHS contemporaneously with individual notifications.

Because NorthShore serves four counties, and because ransomware campaigns typically affect systems broadly rather than narrowly, compliance observers will be watching whether the final patient count triggers those additional notification requirements. The number of affected individuals has not yet been confirmed.

Why Nonprofit Community Health Providers Are Attractive Targets

Community health centers and federally qualified health centers frequently operate on lean technology budgets. They often hold the same breadth of PHI as larger hospital systems, including Social Security numbers tied to Medicaid enrollment and detailed treatment histories, but they may lack dedicated security operations capacity. That combination makes them a practical target for ransomware groups seeking high-value data with lower resistance.

NorthShore Health Centers fits that profile. It serves a multi-county region and holds PHI categories that have strong resale value on illicit markets and strong leverage value in extortion scenarios.

What Compliance Officers Should Do Now

If your organization operates in a similar profile, including rural or regional nonprofit health delivery with broad PHI holdings, this incident warrants an immediate internal review of several areas:

Incident response readiness. Does your organization have a tested, documented incident response plan that covers ransomware specifically? Tabletop exercises should include scenarios involving public threat actor claims.

Breach risk assessment process. Your team should be able to execute the four-factor analysis quickly and consistently. A public ransomware claim is not automatically dispositive, but it raises the evidentiary bar for concluding that no breach occurred.

Notification timeline controls. The 60-day clock begins at discovery, not at the conclusion of a forensic investigation. Many organizations conflate these. Begin parallel-tracking notification logistics from day one of incident response.

Business associate agreements. If any of your technology vendors or service partners have access to PHI and experienced this incident downstream, ensure your BAAs address breach notification obligations correctly.

Status of This Incident

The NorthShore Health Centers investigation is ongoing. No final patient count has been published. No regulatory enforcement action has been initiated or announced. MedComply will update coverage as additional information becomes available.