Mid-Cumberland Human Resource Agency Listed by insomnia Ransomware Group

On May 18, 2026, the Mid-Cumberland Human Resource Agency (MCHRA), a Tennessee nonprofit that provides Meals-on-Wheels, public transit, in-home care, and community corrections services, appeared on the leak site of the insomnia ransomware group. Internal files containing sensitive personal information of clients, employees, and service recipients were allegedly exfiltrated and listed for public download.

What's Publicly Reported from Reporting

Public reporting indicates that MCHRA’s internal files were stolen during a ransomware incident and published on the insomnia group’s dark-web portal. The nonprofit serves vulnerable adults who rely on long-term care, home-delivered meals, accessible transportation, and translation services. No precise victim count has been disclosed, but the exposed data includes records tied to clients receiving in-home services, transit users, and participants in community corrections programs. The leak site lists the organization under its full name with samples of the stolen material now openly available.

Why This Matters for You and Your Family

If you or anyone in your household has used MCHRA services in recent years, your personal details may now sit in a publicly accessible ransomware repository. This includes names, addresses, dates of birth, Social Security numbers, medical or care-related notes, and contact information. Once posted on a leak site, the data does not disappear; it spreads quickly through resale markets and automated scraping tools. For families who depend on Meals-on-Wheels, senior transit, or in-home support, the breach creates immediate risks of identity theft, targeted scams, and unwanted solicitations that feel personal because the criminals already know intimate details about your daily life.

The Doxxing and Identity-Chain Risks

Stolen care-agency records rarely stay isolated. Criminals combine them with other leaks to build detailed profiles that link your real name and address to email accounts, phone numbers, usernames, and even children’s online handles. These identity chains allow attackers to move from one compromised account to the next, turning a single breach into repeated harassment or financial fraud. Credential leaks like this one frequently cascade into gaming account takeovers, especially when family members share devices or reuse passwords. Public reporting shows that children’s profiles tied to a parent’s address are often the fastest route to full household compromise.

Insomnia Group’s Known Track Record

Public reporting attributes the attack to the insomnia ransomware group, which emerged in late 2024. The group has listed dozens of smaller organizations and nonprofits, favoring entities with limited cybersecurity staff. Its typical playbook involves initial access through phishing or unpatched remote desktop services, followed by exfiltration of internal documents before encryption. Insomnia then posts samples on its leak site and demands payment within a short window, often threatening to release the full archive if the deadline passes. The group’s targets have included healthcare-adjacent nonprofits, local government contractors, and community service providers.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the no-subscription cleanup to remove what you can.
• Rotate any password you ever used with MCHRA or related services and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts that can chain back to the same address or leaked records.
• Let DoxxScan remediation specialists handle takedown requests and broker removals while you focus on securing your own accounts.

The incident shows how quickly nonprofit service data can reach criminal hands and why waiting for the next breach is no longer viable. Start your DoxxScan trial today and put continuous monitoring, identity-chain mapping, and hands-on remediation specialists between your family and the growing pile of stolen records. DoxxScan by GalaxyWarden is built precisely for this reality, giving ordinary families the same level of protection once reserved for large organizations.