The ransomware group Stormous has claimed responsibility for stealing data from 600,000 patients of North Country HealthCare, a nonprofit medical provider operating 14 sites across northern Arizona.
North Country HealthCare is a federally qualified health center offering a wide range of services including family medicine, pediatrics, prenatal care, dental care, behavioral health, physical therapy, and telemedicine. It serves patients in 11 communities and provides care regardless of insurance status, with sliding-scale fees for the uninsured.
On July 13, 2025, Stormous added North Country HealthCare to its data leak site, claiming it had obtained highly sensitive personal and medical information. This includes full names, birthdates, contact details, gender, clinic visit dates and locations, insurance providers, diagnostic codes (ICD), and detailed medical diagnoses. The group initially stated that it would sell the data of 100,000 patients and release the remaining 500,000 records publicly at no cost. According to the HIPAA Journal, Stormous published the stolen files on July 15. The report confirms that the leaked information includes both personally identifiable information (PII) and protected health information (PHI), along with diagnostic and clinic data.
Stormous, known for supporting pro-Russian causes, has been active since early 2022. The group follows a double extortion strategy, demanding ransom payments while threatening to publish stolen data. It has attacked over 150 organizations globally, primarily targeting sectors such as healthcare, hospitality, tech, government, and business services, with victims reported in the U.S., France, Spain, the UAE, and Brazil.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
