Physicians Clinic of Iowa Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Physicians Clinic of Iowa was listed by the anubis ransomware group on February 26, 2026, indicating that internal files were exfiltrated in a ransomware attack affecting an undisclosed number of people. Individuals who have received care from the clinic should review any communications from the organization and consider placing a fraud alert or credit freeze if concerned about potential misuse of their information.
Breaking down the breach
The incident came to light through a listing posted by the anubis group on its leak site. The group asserts that it obtained internal files during a ransomware operation targeting the clinic. No official confirmation of the breach, timeline of events, or volume of data has been released by Physicians Clinic of Iowa. The number of people potentially impacted is not publicly reported.
Who is anubis?
Anubis is a ransomware operation that has appeared in public reporting since at least 2024. Like several other groups in this category, it typically uses encryption to disrupt operations and claims to exfiltrate data for leverage. The group maintains a leak site where it lists organizations it says have not met its demands. Such listings represent the group’s own assertions and are not independently verified at the time they appear.
Physicians Clinic of Iowa and its sector
Physicians Clinic of Iowa provides outpatient medical services in the state of Iowa. Organizations of this type routinely maintain records that include patient identifiers, clinical notes, insurance information, and administrative files. Healthcare providers have been frequent targets of ransomware activity because their systems often require continuous access and contain data that can be monetized or used for identity-related crimes.
What data was at risk
The anubis listing refers only to “internal files” that were allegedly exfiltrated. No further breakdown of file categories or record counts has been disclosed. While medical clinics commonly hold protected health information and billing records, the exact contents of the claimed exfiltration have not been confirmed by any public statement from the organization or investigators.
What's at stake
Exposure of internal files from a medical provider can lead to misuse of personal and health information, including attempts at identity theft or insurance fraud. For the clinic, the incident may result in regulatory review, operational disruption, and costs associated with investigation and remediation. Individuals whose records are involved may face long-term monitoring needs, though the scale of any such exposure remains undetermined.
Were you affected?
Patients of Physicians Clinic of Iowa should watch for official notifications from the organization. In the absence of Reported Details, monitoring credit reports and medical statements for unusual activity is a standard precaution. Individuals can also check whether their email address appears in known breach datasets through publicly available exposure scanning tools.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Quest Healthcare Solutions Listed by anubis Ransomware GroupBOSTON ORTHOTICS, INC. Listed by anubis Ransomware GroupQuest Health Solutions Listed by anubis Ransomware GroupSinging River Health System Listed by anubis Ransomware GroupLatest breaches
Publicly posted by anubis — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.