Tri-Cities Gastroenterology Listed by insomnia Ransomware Group

On December 16, 2025, medical practice Tri-Cities Gastroenterology appeared on the leak site of the insomnia ransomware group in a listing claiming internal files were exfiltrated during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the group posted details of the incident on its dark-web leak portal, accessible via the .onion address hosted on ransomware.live. The exposed material consists of internal files taken during the ransomware operation. The number of patients or individuals whose records were compromised remains unknown at this time. Tri-Cities Gastroenterology is a medical provider offering digestive care services in the Tri-Cities region. No evidence has surfaced that the stolen data has been distributed beyond the group’s leak site so far.

Why This Matters for You and Your Family

When a healthcare provider’s systems are breached, the information at risk often includes names, dates of birth, Social Security numbers, addresses, phone numbers, insurance details, and clinical notes. Even if your own records are not confirmed in this specific posting, medical breaches create long-term privacy risks because health data is difficult to change and retains value to identity thieves for years. For you and your family, a single leak can lead to fraudulent insurance claims, unexpected medical bills in your name, or the sale of your contact details on underground markets. Children’s records, sometimes included in family insurance files, face similar dangers once exposed.

The Doxxing and Identity-Chain Implications

Stolen medical files frequently contain enough personal details to link disparate online accounts. A phone number or email from one breach can be combined with information from earlier leaks to map your full digital footprint. This process, known as identity chaining, allows attackers to locate social-media profiles, gaming usernames, and even family members’ accounts. Credential leaks like this one often cascade into account takeovers on unrelated services. Gaming accounts belonging to you or your children are especially vulnerable because they frequently reuse passwords or recovery emails tied to the same household address listed in medical records.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist today.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught within hours rather than months.
• Rotate any password you used on portals or patient systems at Tri-Cities Gastroenterology and replace it with a unique passphrase everywhere it has been reused; enable two-factor authentication through an authenticator app on every account that offers it.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that can be traced back to the same address or parent email.
• Let remediation specialists handle the repetitive work of sending takedown notices to data brokers and monitoring whether any of the exposed files surface for sale.

The incident underscores a simple reality: once medical or personal records leave a provider’s control, you cannot rely on the organization to protect you indefinitely. A forward-looking approach means assuming your information will appear in future leaks and maintaining constant visibility into how it travels online. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting proactive steps now limits what attackers can build from any single breach.