Grandview Family Medicine Listed by Medusa Ransomware Group

On February 8, 2026, Grandview Family Medicine appeared on the Medusa ransomware group’s leak site after the attackers exfiltrated internal files from the Utah-based healthcare provider.

What Public Reporting Shows

Public reporting indicates that Medusa listed Grandview Family Medicine, a clinic offering family medicine, obstetrics, women’s health, men’s health, and pediatrics. The organization operates locations in Provo and Cedar Hills, providing both in-person and telehealth appointments. Its headquarters sits at 1900 North State Street in Provo.

Available reporting describes the incident as a ransomware attack in which internal files were taken. The exact number of patient records or individuals affected remains unknown. No specific data types such as names, addresses, Social Security numbers, or medical histories have been publicly detailed beyond the broad description of internal files exfiltrated.

Why This Matters for You and Your Family

When a local family medicine clinic is hit, the people most likely to be exposed are exactly the patients who trusted it with their health information: parents, children, pregnant mothers, and older relatives. Even without Reported Details on the files, healthcare data tends to include names, dates of birth, contact information, insurance details, and treatment records. Once that information leaves the clinic’s control, it can surface in unexpected places months or years later.

Any family who has visited Grandview Family Medicine since it began offering services should assume their basic personal details may now be in the hands of criminals. This is not a distant corporate breach. It is your neighborhood clinic, the place you take sick kids, schedule prenatal visits, or manage ongoing health conditions.

The Doxxing and Identity-Chain Implications

Healthcare breaches rarely stop at the initial leak. Criminals combine stolen medical files with information from other breaches to build detailed profiles. A phone number found in one record links to an email in another. That email ties to a username used on social media or a child’s gaming account. These connections create an identity chain that makes targeted harassment, identity theft, or extortion far easier.

Credential leaks like this one cascade into account takeovers across unrelated services. A password reused from a patient portal can unlock email, banking, or gaming logins. Children’s gaming accounts are especially vulnerable because kids often use simple passwords or share devices, and parents may not realize the same email address appears in the clinic’s files.

Medusa Group’s Publicly Known Track Record

Public reporting attributes the attack to the Medusa ransomware group. The group emerged in 2021 and has since targeted organizations across multiple sectors. Notable prior victims include healthcare providers, municipalities, and private businesses whose data appeared on the same leak site. Their typical playbook involves gaining initial access, exfiltrating sensitive files, encrypting systems, and then demanding payment while threatening to publish the stolen data if the ransom is not met. Medusa often sets short deadlines once a victim is listed publicly.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see the full exposure picture.
• Rotate any password you ever used at Grandview Family Medicine or its patient portal anywhere else it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that can chain back to the same address or parent email.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and monitoring for reappearance of your information.

The incident shows that even small, local clinics can become targets, and the data they hold about your family does not lose its value to criminals over time. Taking deliberate steps now limits how far those stolen files can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process gives you both visibility and expert help exactly when everyday families need it most.