Gastroenterology & Hepatology of CNY Listed by exitium Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 14, 2026, the ransomware group exitium listed Gastroenterology & Hepatology of CNY on its site. The entry states that internal files were taken in a ransomware incident and offers a data sample for sale if demands were not met. Public information does not confirm the scale of any exposure or whether the claims have been independently verified. The listing affects a medical practice that provides gastroenterology and hepatology services in Syracuse, New York, and operates an associated endoscopy center. Individuals whose records may be involved face potential privacy and identity risks if the described material circulates.

What happened

The reported event centers on a ransomware attack against Gastroenterology & Hepatology of CNY in which files were removed from internal systems. The date of the intrusion itself is not stated in available records. The number of people whose information may have been taken remains undisclosed beyond the group's listing. The entry indicates that the full set of data would be offered for sale absent payment.

The group behind it: exitium

Exitium is a ransomware operator that follows a double-extortion pattern: it encrypts systems and removes copies of data, then uses a leak site to pressure victims. The group has listed multiple organizations in the past and has released samples to demonstrate the contents it claims to hold. Its listings function as assertions by the actor rather than confirmed outcomes of each incident.

About Gastroenterology & Hepatology of CNY

The organization is a gastroenterology and hepatology practice that also runs an AAAHC-accredited endoscopy center under the related name Digestive Disease Center of CNY, LLC. Practices of this type maintain detailed clinical records to support diagnosis, treatment, and follow-up care for digestive-system conditions. Such records routinely include identifiers and medical details that are protected under health-privacy regulations.

The information in question

The listing describes internal files removed during the ransomware event. The group presents a sample that it states covers 167,303 patient records, including Social Security numbers for 124,761 individuals along with addresses, phone numbers, email addresses, diagnoses coded in ICD-10 format, medications, and pathology reports. The precise contents and completeness of any exfiltrated material have not been independently confirmed.

What's at stake

Exposure of Social Security numbers and contact details can enable identity theft or account takeover attempts. Medical information such as diagnoses and medication lists can reveal private health conditions that patients may prefer to keep confidential. For the practice, the incident adds administrative burden, potential regulatory review, and costs associated with investigation and notification even when the full extent of access remains unclear.

If your data was in this claimed breach

Individuals can take measured steps to limit further exposure. Public details on the exact scope are limited, so verification through official channels is advisable.

• Review statements from the practice for any formal notification and follow its instructions on credit monitoring or identity protection services if offered.
• Place a credit freeze or fraud alert with major credit bureaus to restrict new account openings.
• Monitor financial and medical accounts for unusual activity and request free annual credit reports.
• Run a free exposure scan of your email address against known breach data sets to check for appearances in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.