Cameron Regional Medical Center Listed by anubis Ransomware Group

On August 3, 2026, the ransomware group Anubis publicly listed Cameron Regional Medical Center on its leak site, claiming the healthcare provider was hit by a ransomware attack in which internal files were exfiltrated. The organization has not, as of this writing, issued any public confirmation or breach notification. According to the leak-site listing, patient and employee data were among the information compromised in the incident.

Leak Site Claim Details

The Anubis leak site states that it successfully deployed ransomware against Cameron Regional Medical Center and exfiltrated internal files before encrypting systems. The listing does not quantify the number of records involved, nor does it specify exactly which categories of data were taken beyond describing them as internal files. A countdown timer typical of extortion operations is visible on the page, but no specific ransom amount or deadline is detailed in the publicly indexed portion of the listing. Because the primary disclosure comes solely from the threat actor’s own leak site via ransomware.live, this remains an unconfirmed claim. Cameron Regional Medical Center has not publicly acknowledged the incident or validated the group’s assertions.

Why This Matters for You and Your Family

When a healthcare provider is targeted, the information at risk usually includes names, dates of birth, Social Security numbers, medical diagnoses, treatment records, insurance details, and employee payroll or HR files. Even though the exact volume of data is unknown, any exposure of such records creates long-term identity theft and fraud risk for patients and staff. If you or any member of your family has received care at Cameron Regional Medical Center, your personal and medical information may now be in the hands of criminals who specialize in monetizing stolen data through extortion, identity theft, or sale on underground markets.

Doxxing and Identity-Chain Risks

Medical breaches are especially dangerous because they frequently link your real identity to addresses, phone numbers, email accounts, and family relationships. These details allow attackers to build detailed identity chains that reach beyond the initial breach. A leaked home address, for example, exposes everyone who lives at that location. Children’s gaming accounts or social media handles that reuse the same email or password can be quickly compromised, leading to further doxxing. Public reporting on similar healthcare incidents shows that once initial data appears on a leak site, follow-on sales and targeted phishing attempts often follow within weeks.

Anubis Ransomware Group Track Record

Public reporting attributes the emergence of Anubis to late 2024. The group has since targeted organizations across multiple sectors, with a noticeable focus on healthcare and mid-sized enterprises. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration prior to encryption. Like many contemporary ransomware operations, Anubis uses double-extortion tactics: they threaten both to lock victim systems and to publish stolen data unless payment is made. While not currently ranked among the most prolific ransomware families, their public leak site and willingness to post victim data indicate they follow through on extortion threats when ransoms are not paid.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity, including any past connection to Cameron Regional Medical Center.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so new exposures tied to this incident are detected and surfaced quickly.
• Rotate any password you have ever used at Cameron Regional Medical Center or its patient portal anywhere it is reused, and switch to a hardware-backed or authenticator-based 2FA method immediately.
• Let remediation specialists perform hands-on takedown requests across data brokers and extortion-related sites on your behalf.
• Note that a leaked home address from a healthcare breach puts every person at that address at higher risk, and your own removal actions are what ultimately reduce that exposure in public databases.

The incident underscores how quickly healthcare data can move from protected systems into criminal hands, often before the affected organization has time to notify patients. A single breach like this can feed identity theft attempts for years. Using DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, and specialist remediation support gives individuals a practical way to track and reduce the long-term exposure that follows such claims. Stay vigilant and act on your own data before criminals do.