Our Hospice Of South Central Indiana Listed by Storm Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organizations by posting alleged victims on leak sites, often before any independent confirmation exists. These listings function as extortion tools: they name a target, threaten publication, and invite attention, whether or not the underlying claim has been verified by the organization, a regulator, or a breach index.

On September 09, 2026, the group known as Storm listed Our Hospice Of South Central Indiana on its leak site. The listing presents the organization as a healthcare provider in Columbus, Indiana. Public detail in the listing is limited. The number of people who might be affected is unknown, and the types of data the group claims to hold are not disclosed. Our Hospice Of South Central Indiana has not publicly confirmed the claim as of writing. What follows treats Storm’s post as an unverified claim and explains what such a listing does and does not establish.

Inside the listing

According to the listing, Storm has named Our Hospice Of South Central Indiana and associated the organization with healthcare operations in Columbus, Indiana, United States. The reported summary describes the provider’s role in end-of-life and related support services across South Central Indiana, notes an address at 2626 E. 17th Street, Columbus, IN 47201, and indicates an employee range of roughly 51–200. Beyond that framing, the public listing does not supply a claimed timeline of any intrusion, a method of access, a volume of files, or a verified count of affected individuals.

People affected are recorded as unknown. Data types named as exposed are not disclosed. No dollar figure, file inventory, or technical narrative appears in the facts available for this write-up. In practical terms, a leak-site entry of this kind is a claim by the posting group. It does not, by itself, prove that systems were compromised, that files left the organization, or that any particular record set is in third-party hands. Until the organization or another authoritative source confirms or denies the allegation, the responsible posture is to treat the listing as unproven and to avoid stating outcomes as settled fact.

Who is Storm?

Storm is known in public reporting as a ransomware and extortion-style actor that pressures organizations by encrypting systems or by threatening to publish material it claims to have taken. Groups in this category commonly maintain leak sites where they list alleged victims, post sample descriptions, and set deadlines intended to force negotiation. Their public posts are marketing and leverage as much as evidence: they may exaggerate scope, recycle older material, or list entities for which independent confirmation never appears.

Well-documented patterns for such crews include double-extortion messaging—pairing operational disruption with the threat of data exposure—and opportunistic targeting across sectors that hold sensitive personal or operational information, including healthcare-adjacent providers. None of that general profile converts Storm’s listing of Our Hospice Of South Central Indiana into a verified incident. For this specific name, the only grounded statement is that the group has listed the organization and that the group claims an association with a breach scenario. Claims the group makes about this victim beyond the sparse listing details should be read as the group’s assertions, not as an audited inventory.

About Our Hospice Of South Central Indiana

Our Hospice Of South Central Indiana is described in the available summary as a provider of compassionate end-of-life care and support for patients and families in South Central Indiana. Services referenced include hospice care, personal care, palliative care, bereavement care, and specialized programs for veterans and pediatric patients, with an emphasis on comfort, dignity, and community-based support across 22 counties and 24/7 availability for those in need. The organization is situated in Columbus, Indiana, with the address noted above and a mid-sized staff footprint in the 51–200 employee range.

Hospice and palliative organizations sit at a sensitive intersection of clinical, personal, and family information. Even when no breach is confirmed, a public extortion listing matters because patients, families, staff, and partners may see the name and reasonably ask whether their information could be involved. The consequence of the listing is therefore partly informational and reputational: it creates uncertainty that must be handled carefully, without treating the attacker’s page as a final record of what occurred.

The information in question

The facts state that data types named as exposed are not disclosed. It is therefore not possible to assert that any specific category of record was taken, copied, or published. Storm’s listing does not provide a reliable inventory, and attacker descriptions of “what they have” are not independent verification.

If files from a hospice or similar care organization were ever obtained by an unauthorized party, organizations in this sector typically hold combinations of identity data, contact details, insurance or billing information, clinical and care-planning notes, next-of-kin and emergency contacts, and administrative records related to staff and vendors. Pediatric and veteran-focused programs can involve additional sensitive context. Those are sector norms, not a statement of what—if anything—left Our Hospice Of South Central Indiana. Exact contents tied to this listing remain unconfirmed, and no affected-person count is known.

What's at stake

For individuals, the stake is conditional. If personal or care-related information were involved in a real incident, risks could include targeted phishing that references hospice or family circumstances, attempts to socially engineer access to accounts or benefits, and misuse of identity details for fraud. Family members named as contacts could face similar outreach. None of that should be read as a declaration that such data is already circulating from this listing; it is the standard risk profile people weigh when a healthcare-adjacent name appears on an extortion site.

For the organization, an unverified listing still creates operational and trust pressure: inquiries from patients and partners, the need for careful public communication, and the cost of determining whether the claim has any basis. A leak-site post does not establish negligence, security failures, or internal priorities. It establishes only that a named group chose to publish the organization’s name in an extortion context. Separating that distinction protects readers from false certainty and protects reporting from treating accusation as proof.

Steps worth taking either way

Because the incident is unconfirmed and data details are undisclosed, actions should stay practical and conditional—useful whether or not Storm’s claim is later substantiated.

• If you are a patient, family member, or staff contact, treat unexpected calls, texts, or emails that cite hospice care, billing, or bereavement support with caution; verify through official channels you already trust rather than numbers or links in the message.
• If you suspect your identity details could be misused in any breach context, consider placing a fraud alert or credit freeze with major credit bureaus and monitoring financial and insurance statements for unfamiliar activity.
• Use unique passwords and multi-factor authentication on email and benefits portals so a single exposed credential is less useful, if any credential were ever involved.
• Prefer official notices from the organization or regulators over screenshots and forum posts when deciding what applies to you.
• You can run a free exposure scan of your email to check whether your address has already appeared in known breach datasets unrelated to this claim, which helps separate general exposure hygiene from this specific listing.

Storm has listed Our Hospice Of South Central Indiana; the organization has not publicly confirmed the claim as of writing; affected numbers are unknown; and exposed data types are not disclosed. Readers are best served by calm verification habits and by treating leak-site claims as claims until stronger evidence appears.

AICompiled with AI assistance from public sources and published under our editorial standards.