Grandview Family Medicine Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Grandview Family Medicine was listed by the medusa ransomware group on February 14, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of individuals may have been affected; anyone connected to the practice should review their records and consider protective steps such as monitoring accounts and changing passwords.
Inside the incident
The only confirmed detail is that internal files were allegedly exfiltrated during a ransomware attack. No information has been made public about the date of the intrusion, the method of initial access, the volume of data taken, or whether any systems were encrypted. The listing on the group’s site constitutes the group’s claim of involvement; independent confirmation of the incident’s scope has not been reported.
Inside medusa
Medusa is a ransomware operation that follows a double-extortion model: it encrypts files on targeted systems and also removes copies of data before demanding payment. The group maintains a leak site where it publishes victim names and sample files when negotiations fail. It has been observed targeting organizations across multiple sectors, including healthcare, and typically seeks access through common vectors such as remote-desktop services or unpatched software.
Who is Grandview Family Medicine?
Grandview Family Medicine operates clinics in Provo and Cedar Hills, Utah, providing family medicine, obstetrics, women’s and men’s health, pediatrics, chronic-disease management, mental-health support, urgent visits, and minor procedures. The practice offers both in-person and telehealth appointments and maintains its headquarters at 1900 North State Street in Provo. Organizations of this type routinely collect and store patient identifiers, clinical notes, insurance information, and appointment records.
What data was at risk
The only data category disclosed is “internal files exfiltrated in ransomware attack.” Specific file types, patient counts, or record categories have not been published. Healthcare providers routinely hold protected health information, demographic details, billing records, and correspondence; whether any of these categories were among the files removed in this case remains unconfirmed.
Why it matters
Medical practices hold information that can be used for identity theft, insurance fraud, or targeted scams. When internal files are removed, patients may face uncertainty about whether their records have been copied or will later appear on public forums. For the organization, the incident adds administrative burden, potential regulatory review, and the need to assess whether any systems require remediation.
If your data was in this claimed breach
Monitor bank and insurance statements for unusual activity and consider placing a fraud alert with credit bureaus. Contact Grandview Family Medicine directly for any official notices it may issue. Individuals can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Resource Corporation of America Listed by medusa Ransomware GroupMESA Products Listed by medusa Ransomware GroupBalloons Everywhere Listed by medusa Ransomware GroupSouth Hays Fire Department Listed by medusa Ransomware GroupLatest breaches
Publicly posted by medusa — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.