Optimum Health Institute Listed by insomnia Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Optimum Health Institute was listed by the insomnia ransomware group on December 22, 2025. The listing states that internal files were exfiltrated during a ransomware attack. The number of people affected is not known, and no further details on the volume or specific nature of the files have been released. The incident is significant because Optimum Health Institute holds records tied to participants in multi-week residential programs. Even limited disclosure of such records can create lasting privacy and operational consequences for the individuals involved.

What happened

On December 22, 2025, the insomnia ransomware group added Optimum Health Institute to its leak-site listing. The entry claims that internal files were taken from the organization during a ransomware intrusion. No confirmation of the claim has been issued by Optimum Health Institute, and no independent verification of the data has been made public. The scale of the intrusion, the method of initial access, and any ransom demand or payment remain undisclosed.

Inside insomnia

The insomnia ransomware group is a known threat actor that has conducted multiple operations involving encryption of systems followed by the publication or threatened publication of stolen data. Its typical approach includes targeting organizations across sectors and using a leak site to pressure victims. Public reporting on the group has documented repeated use of this double-extortion model in prior incidents. In this case, the group’s listing of Optimum Health Institute constitutes an unverified claim; no additional statements or evidence from the group about this specific victim have been confirmed.

About Optimum Health Institute

Optimum Health Institute operates faith-based, holistic wellness retreats lasting three weeks at locations in San Diego and Austin. The programs combine structured classes, physical activities, and prepared meals intended to support stress reduction, physical fitness, and spiritual development. Organizations of this type routinely collect and retain participant information that includes registration details, health-related disclosures, payment records, and correspondence tied to program attendance.

What was likely exposed

The only data category named in connection with the incident is internal files exfiltrated during the ransomware attack. The precise contents of those files have not been disclosed. Organizations operating residential wellness programs commonly maintain records that can include names, addresses, contact information, payment details, and limited health or dietary information supplied by participants. Because the exact files have not been described, it is not possible to confirm whether any of these categories were present or how many individuals are referenced.

The real-world impact

Individuals whose information appears in internal files held by a retreat operator may face risks of unwanted contact, misuse of personal details, or exposure of sensitive health-related notes. The organization itself faces potential disruption to operations, costs associated with investigation and remediation, and loss of participant trust. Because the number of records and the sensitivity of the specific files remain unknown, the full scope of these effects cannot yet be measured.

Were you affected?

Anyone who attended a program at Optimum Health Institute or provided personal information to the organization should monitor their financial accounts and email for unusual activity. Contacting the organization directly can provide the most current information available about the incident. Individuals can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.