Modoc Medical Center Listed by worldleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Modoc Medical Center was listed by the worldleaks ransomware group on February 16, 2026, after internal files were exfiltrated in a ransomware attack; the date of the intrusion itself has not been established. Anyone who has received care or worked at the facility should check for follow-up notices from Modoc Medical Center and consider monitoring their accounts for unusual activity.
What happened
The listing was reported on February 16, 2026. No further public details have been released about when the underlying attack occurred, how many systems were affected, or the method of initial access. The only information provided is that the group claims internal files were taken during a ransomware operation.
Who is worldleaks?
Worldleaks is a ransomware group that has appeared in public reporting as an actor that targets organizations, encrypts systems, and exfiltrates data before listing victims on an associated leak site. Groups operating in this manner commonly use the threat of data release to pressure victims into paying a ransom. Public records show similar actors have claimed activity against entities in multiple sectors, though specific claims about any single victim remain unverified until confirmed by the organization or independent investigation.
About Modoc Medical Center
Modoc Medical Center operates as a healthcare service provider in Alturas, California. It maintains a 24-hour emergency department along with surgery, laboratory, radiology, physical rehabilitation, and skilled nursing services. The center also runs clinics that deliver primary and specialty care to the surrounding area. Facilities of this type routinely process and retain records that include patient identifiers, treatment histories, and administrative details necessary for clinical operations.
What data was at risk
The available information states only that internal files were exfiltrated. The precise contents of those files have not been disclosed. Healthcare providers of this scale typically maintain electronic health records, insurance details, laboratory results, and staff-related documentation. Without additional confirmation, the exact categories of data involved in this incident remain unconfirmed.
What's at stake
Individuals whose records may be present in the exfiltrated files face the possibility that personal health information could be used for identity-related activity or sold on underground forums. For the organization, the incident carries potential regulatory reporting obligations under healthcare privacy rules and may require extended efforts to restore systems and review access controls. The absence of a confirmed count of affected individuals limits the ability to assess the full scope at this stage.
If your data was in this claimed breach
Review any notifications issued by Modoc Medical Center and consider placing a fraud alert with credit reporting agencies. Monitor financial and insurance accounts for unusual activity. Individuals can also run a free exposure scan of their email address against known breach data sets to check for additional appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Access Dental Listed by worldleaks Ransomware GroupVirginia Health Services Listed by worldleaks Ransomware GroupLegacy Health LLC Listed by worldleaks Ransomware GroupSagent Pharmaceuticals Listed by worldleaks Ransomware GroupLatest breaches
Publicly posted by worldleaks — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.