Mediprobe Research Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target research and clinical organisations, treating specialised medical data as leverage in double-extortion campaigns that combine encryption with public threats to publish stolen files. Against that backdrop, the appearance of Mediprobe Research on a ransomware leak site in early May 2025 fits a familiar pattern of claims against entities that handle sensitive health-related information.

Public reporting indicates that the ransomware group known as rhysida listed Mediprobe Research, a dermatology research and clinical trials centre, as a victim. The number of people affected remains unknown, and the only data category publicly named is internal files said to have been exfiltrated. The listing itself constitutes a claim by the group rather than an independently confirmed breach disclosure from the organisation.

What happened

On or around 5 May 2025, Mediprobe Research appeared on the leak site operated by the rhysida ransomware group. The group’s listing asserted that internal files had been exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data taken, or any ransom demand—have been made public. The number of individuals whose information may have been involved is listed as unknown. At the time of reporting, no confirmation or detailed statement from Mediprobe Research itself had been incorporated into the available public record of the incident.

Because the primary source of the allegation is the threat actor’s own site, the claim must be treated as unverified until corroborated by the organisation or by independent forensic findings. Public detail on the scale, timeline and exact contents of any compromise therefore remains limited.

Inside rhysida

Rhysida is a ransomware operation that emerged in mid-2023 and has since conducted double-extortion campaigns against organisations across healthcare, education, government and private industry. The group typically encrypts systems, steals data, and then posts victim names on a dedicated leak site while threatening to release the material if payment is not made. Rhysida has been observed using common initial-access techniques such as phishing, exploitation of unpatched remote services, and compromised credentials, followed by lateral movement and data staging before encryption. Its public listings frequently include sample files or directory listings intended to pressure victims and demonstrate possession of data.

In the case of Mediprobe Research, the group’s site simply listed the organisation and claimed that internal files had been taken. No additional statements, sample data, or specific accusations about Mediprobe’s security posture have been reported beyond that listing. As with other rhysida claims, the appearance of a name on the leak site does not by itself prove the full extent of any intrusion or the accuracy of the group’s assertions.

Mediprobe Research and its sector

Mediprobe Research Inc. describes itself as a dermatology research and clinical trials centre. Organisations of this type design, conduct and manage studies involving human participants, often collecting medical histories, diagnostic images, laboratory results, demographic details and consent documentation. They may also hold contracts, intellectual property related to trial protocols, and correspondence with sponsors, regulators and investigators.

A breach affecting such an entity is consequential because clinical-trial data frequently includes sensitive health information that is protected under privacy regulations and that participants expect to remain confidential. Even limited exposure of internal research files can raise concerns about participant privacy, trial integrity and the organisation’s ability to continue studies without interruption. The broader dermatology and clinical-research sector has seen repeated targeting by ransomware groups precisely because the combination of personal health data and operational urgency creates strong pressure to resolve incidents quickly.

The information in question

The only data category named in public reporting is “internal files exfiltrated in ransomware attack.” No further breakdown—such as patient records, trial participant identifiers, financial documents, employee data or intellectual property—has been disclosed. The number of people potentially affected is explicitly unknown.

Organisations engaged in dermatology research and clinical trials typically hold a range of sensitive materials: informed-consent forms, medical questionnaires, photographs or scans of skin conditions, laboratory results, adverse-event reports, and administrative records containing names, contact details and health identifiers. Whether any of those categories were among the files claimed by rhysida remains unconfirmed. Until Mediprobe Research or an independent investigation provides a verified inventory, the exact contents of any exfiltrated material cannot be stated as fact.

The real-world impact

For individuals whose data may have been involved, the primary risks include identity theft, medical fraud, and unwanted contact or social-engineering attempts that exploit knowledge of a person’s health status or participation in a trial. Even if only internal administrative files were taken, those documents can contain enough personal detail to enable targeted phishing or blackmail. Because the number of affected people is unknown and the precise data types unconfirmed, the scale of individual harm cannot yet be quantified.

For Mediprobe Research itself, the consequences may include operational disruption, regulatory scrutiny, loss of participant trust, and potential contractual or reputational effects with trial sponsors. Clinical-research organisations often operate under strict data-protection and ethical-oversight requirements; any confirmed compromise can trigger mandatory notifications, audits and remediation costs. The mere public listing by a ransomware group can also create uncertainty among current and prospective study participants until clearer information is released.

Were you affected?

If you have participated in a clinical trial or study conducted by Mediprobe Research, or if you are an employee, contractor or partner of the organisation, monitor official communications from the company for any confirmed breach notification. In the meantime, remain alert to unexpected emails, calls or messages that reference medical research or personal health details, and treat unsolicited requests for information or payment with caution. Consider placing fraud alerts with credit-reporting agencies and reviewing account statements for unusual activity.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for assessing broader exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.