Greene Acres Nursing Home Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and long-term care providers, exploiting the sensitive nature of patient and operational data to pressure organizations into paying ransoms. In this environment, listings on criminal leak sites have become a common way for attackers to claim success and escalate demands, even when independent verification remains limited.

On September 20, 2024, Greene Acres Nursing Home was listed by the rhysida ransomware group, which claims to have exfiltrated internal files during a ransomware attack. The number of people affected is unknown, and public detail on the precise scope remains limited. The incident matters because nursing homes hold highly personal information about residents and staff, and any unauthorized access can create lasting risks for those individuals.

Inside the incident

According to available reports, Greene Acres Nursing Home appeared on a rhysida leak site on September 20, 2024. The group claims that internal files were exfiltrated as part of a ransomware attack. No confirmed figures have been released for the volume of data taken, the number of individuals affected, or the exact method of initial access. Timing of the intrusion itself, beyond the listing date, has not been publicly disclosed. The listing itself constitutes an unverified claim by the threat actor; independent confirmation of the full extent of the breach has not been detailed in the available record.

Public information stops at the assertion that internal files were removed. No ransom demand amount, negotiation timeline, or confirmation of data publication has been included in the facts surrounding this listing. As with many such incidents, organizations and affected parties often learn of the claim through monitoring of criminal forums rather than through immediate official statements.

Who is rhysida?

Rhysida is a ransomware operation that became publicly active in mid-2023. The group typically employs a double-extortion model: encrypting systems while also stealing data and threatening to release it if payment is not made. Victims are commonly listed on a dedicated leak site, where the group posts samples or full archives to demonstrate possession of the material. Rhysida has previously targeted a range of sectors, including healthcare, education, and government entities, often using phishing or exploitation of unpatched vulnerabilities as initial entry points. The group has been observed deploying ransomware that renames files with a distinctive extension and leaving ransom notes that direct victims to Tor-based negotiation portals.

In this case, the group claims Greene Acres Nursing Home as a victim and asserts that internal files were taken. No further statements from rhysida specifically detailing this organization’s data beyond the general claim of exfiltration appear in the public record of the listing. Attribution rests on the group’s own leak-site post rather than on forensic confirmation released by the victim or law enforcement.

About Greene Acres Nursing Home

Greene Acres Nursing Home is described as a recognized leader in the provision of superior rehabilitation and long-term care services. It is the largest non-profit nursing home in Greene County. Organizations of this type provide skilled nursing, rehabilitation therapy, and residential care for elderly and medically complex residents. They routinely manage medical records, medication histories, insurance details, family contact information, and staff employment data.

A breach involving such a facility is consequential because residents often cannot easily monitor or respond to identity risks themselves. The non-profit status and community role of the home mean that any disruption or loss of trust can affect both care continuity and the willingness of families to place loved ones in the facility. Healthcare and long-term care providers remain high-value targets precisely because of the sensitivity and longevity of the data they hold.

The information in question

The available facts state that internal files were exfiltrated in a ransomware attack. No specific categories of personal data—such as names, Social Security numbers, medical diagnoses, or financial records—have been named as confirmed contents of the stolen material. The number of people affected remains unknown.

Nursing homes and similar long-term care organizations typically maintain electronic health records, admission paperwork, billing information, emergency contacts, and employee files. These materials can include dates of birth, addresses, insurance identifiers, and clinical notes. Because the exact contents of the files claimed by rhysida have not been independently detailed or confirmed, it is not possible to state with certainty which of these data types, if any, were included. Public detail is limited to the group’s assertion that internal files were taken.

Why it matters

For residents, family members, and staff, the primary risk is that personal information could be used for identity theft, medical fraud, or targeted social-engineering attempts. Even limited internal documents can contain enough identifiers to open fraudulent accounts or to craft convincing phishing messages. Because medical and care-related data often remains relevant for years, the window of potential misuse can be long.

For the organization, the incident creates operational, legal, and reputational pressures. Ransomware can disrupt care systems, force temporary reliance on paper processes, and require costly recovery efforts. Regulatory obligations under health-privacy rules may require notifications and investigations once the scope is better understood. The claim of data theft, even if not fully verified, can erode confidence among residents and their families at a time when trust is essential to the facility’s mission.

What to do if you're exposed

If you are a resident, family member, or employee of Greene Acres Nursing Home, begin by monitoring financial accounts and credit reports for unexpected activity. Consider placing a fraud alert or credit freeze with the major credit bureaus. Be cautious of unsolicited calls or emails that reference the facility or request personal details; verify any such contact through known official channels. Keep records of any correspondence you receive from the organization about the incident.

Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. This step provides an additional early-warning signal and can help prioritize further protective measures while more details about this specific listing become available.

AICompiled with AI assistance from public sources and published under our editorial standards.