Friendship House Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a mental-health and substance-abuse clinic appears on a ransomware group's leak site, the people who matter most are patients, former patients, and staff whose personal and clinical information may have been taken. Public reporting does not yet say how many individuals are involved or exactly which records left the network, so anyone who has used Friendship House services has reason to treat the listing as a serious, if still incomplete, warning.

On 25 February 2025, Friendship House was listed by the medusa ransomware group. The group claims it exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and further technical detail has not been disclosed.

Breaking down the breach

According to the available record, Friendship House was listed by the medusa ransomware group on 25 February 2025. The listing asserts that internal files were exfiltrated during a ransomware attack. No public confirmation of the intrusion method, the precise date the network was compromised, the volume of data taken, or any ransom demand has been released. The count of affected individuals is listed as unknown. Beyond the claim that internal files were removed, the record does not name specific file categories, systems, or confirmation that data has been published. In short, the incident is known primarily through the group's leak-site claim; independent verification of scale and contents has not been made public.

Who is medusa?

Medusa is a ransomware operation that has been active for several years and is widely documented in open-source reporting. Like many modern ransomware groups, it typically follows a double-extortion model: encrypting systems while also copying data, then threatening to publish or sell the stolen material if a ransom is not paid. The group maintains a public leak site where it names victims and, in some cases, posts sample files or full archives. Listings on that site are claims by the group itself; they do not automatically prove that every assertion is accurate or that data has already been released. Medusa has previously targeted organisations across healthcare, education, manufacturing and professional services. Its operators are known to pressure victims by setting countdown timers and by gradually releasing data. None of these general patterns should be read as What's Publicly Reported about the Friendship House incident beyond the single claim that internal files were exfiltrated.

Friendship House and its sector

Friendship House is described as a clinic that provides outpatient and inpatient services for the treatment of mental health and substance abuse. Its corporate office is located at 406 W Koenig St, Grand Island, Nebraska, 68801, United States, and the organisation is reported to have nine employees. Facilities of this type routinely handle highly sensitive information: clinical notes, diagnoses, treatment plans, medication records, insurance and billing data, contact details, and sometimes family or emergency-contact information. Because mental-health and substance-use records carry particular stigma and legal protections, a breach at such a provider can have lasting consequences for patients even when the organisation itself is small. The limited size of the staff does not reduce the sensitivity of the data; it simply means that operational and clinical records are often concentrated in fewer systems.

What was likely exposed

The only data type named in the public record is “internal files exfiltrated in a ransomware attack.” No inventory of those files has been released, and the number of people affected is unknown. Organisations that deliver mental-health and substance-abuse care typically hold patient demographic data, clinical documentation, insurance identifiers, payment records, and staff personnel files. Whether any of those categories were among the files allegedly taken from Friendship House remains unconfirmed. Readers should therefore treat the following as the limited public picture rather than as verified contents:

• Internal files claimed by medusa to have been exfiltrated
• Exact file types, volumes and patient or staff identifiers: not disclosed
• Number of individuals whose data may be involved: unknown
• Any confirmation that data has been published or sold: not reported

Why it matters

For patients and former patients, the practical risk is misuse of sensitive health information—identity theft, insurance fraud, targeted phishing that references real treatment details, or social embarrassment if clinical material surfaces. Even incomplete records can be combined with other breached data to create convincing scams. Staff face similar exposure of employment and personal details. For the organisation itself, the incident raises operational, regulatory and reputational questions common to healthcare providers after a ransomware claim: possible notification duties, disruption of care systems, and the need to verify what left the network. Because the scale remains unknown, the full extent of these risks cannot yet be measured. The absence of confirmed numbers does not mean the risk is low; it means affected people must act on incomplete information.

Were you affected?

If you have received services from Friendship House or worked there, treat the listing as a prompt to take basic protective steps while more detail is awaited. Monitor financial and insurance statements for unfamiliar activity, be cautious of unexpected emails or calls that reference mental-health or substance-use treatment, and consider placing fraud alerts with credit bureaus if you believe your identifiers may have been involved. Change passwords on any accounts that reused credentials linked to the clinic, and enable multi-factor authentication where available. Because public confirmation of exact data is still missing, these measures are precautionary rather than proof that your records were taken. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.