Minnesota Hospital Listed by radiant Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare providers at a steady pace, using data theft and public pressure as leverage when encryption alone does not produce payment. In this environment, even a listing on a leak site can signal real risk for patients and staff whose information may have been taken.

On October 12, 2025, Minnesota Hospital appeared on a site operated by the ransomware group radiant. The group claims it has exfiltrated internal files and has set a short deadline for contact, after which it says it will begin a public pressure campaign. The number of people affected remains unknown, and independent confirmation of the full scope is not yet public.

What happened

Public reporting states that Minnesota Hospital was listed by the radiant ransomware group on October 12, 2025. According to the group’s own notice, internal files were exfiltrated during a ransomware attack. The listing includes a demand that the organisation contact the group within seven days or face exposure of the hospital’s name, addition of a “view more” button, and the start of a pressure process. No further technical details about the intrusion method, the precise date of the attack, or the volume of data taken have been disclosed in the available record. The number of individuals whose information may be involved is listed as unknown.

Inside radiant

Radiant is a ransomware operation that follows the now-common double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to increase pressure on the victim. Groups of this type typically post victims on dedicated leak sites, set short deadlines, and escalate by releasing sample files or full archives if payment is not made. Prior activity by radiant and similar actors has focused on organisations that hold large volumes of sensitive records and that may face operational or regulatory consequences from prolonged disruption. In this case the group claims Minnesota Hospital is among its victims and that internal files were taken; that claim has not been independently verified in the public facts available.

Minnesota Hospital and its sector

Minnesota Hospital is a healthcare provider. Hospitals of this kind routinely manage electronic health records, billing information, staff credentials, and operational documents that keep clinical services running. The healthcare sector remains a frequent target for ransomware because the combination of sensitive personal data and the need for continuous patient care creates strong incentives to resolve incidents quickly. A listing of this nature therefore raises immediate questions about both patient privacy and the continuity of care, even when the full technical picture is still incomplete.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No inventory of specific file categories, patient records, or employee data has been released. Organisations in the hospital sector typically hold medical histories, insurance details, contact information, and administrative documents. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of those categories, if any, were among the files taken. The group’s claim is limited to the fact of exfiltration of internal material.

Why it matters

For individuals whose information may have been involved, the practical risks include identity theft, medical fraud, and unwanted contact if personal details surface later. For the hospital itself, the incident can bring operational disruption, regulatory scrutiny, and the cost of investigation and notification. Even when the scale is unknown, the mere assertion that internal files left the network is enough to warrant careful monitoring by anyone who has been a patient or employee. Public pressure campaigns of the kind radiant describes can also amplify reputational harm and complicate recovery.

Were you affected?

If you have been a patient, employee, or contractor of Minnesota Hospital, treat the listing as a reason to take basic protective steps while waiting for official confirmation.

• Monitor bank, credit-card, and insurance statements for unfamiliar activity.
• Consider placing a fraud alert or credit freeze with the major credit bureaus.
• Change passwords on any accounts that reuse credentials you may have shared with the hospital, and enable multi-factor authentication where available.
• Watch for phishing messages that reference the hospital or claim to offer breach-related help.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Official notices from the hospital, if they are issued, will provide the most reliable guidance on next steps and any free credit-monitoring offers. Until then, the measures above remain the most practical response available to individuals.

AICompiled with AI assistance from public sources and published under our editorial standards.