Raise the Bottom Listed by cmdorganization Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 15, 2026, the ransomware group cmdorganization listed Raise the Bottom on its leak site. The listing states that internal files were exfiltrated during a ransomware attack against the Idaho-based opioid treatment provider. No information has been released on the number of individuals affected or the volume of data involved. The incident reflects a continuing pattern in which ransomware operators target organizations that hold operational records tied to medical care. Public reporting on such listings often precedes or follows demands for payment, though confirmation of any payment or data release remains unavailable in this case.

Breaking down the breach

The only confirmed detail is the May 15, 2026 listing itself and the statement that internal files were taken. No timeline for initial access, encryption, or exfiltration has been disclosed. The number of records or files is not stated, and no sample data has been described in public reporting tied to this listing.

Raise the Bottom operates outpatient medication-assisted treatment programs at locations in Boise, Nampa, and Pocatello. The organization provides services that include Suboxone, methadone, and Vivitrol along with therapy. No further technical indicators, such as the initial vector or tools used, have been made public.

The group behind it: cmdorganization

Cmdorganization is a ransomware operator that maintains a leak site where it lists organizations it claims to have compromised. Groups of this type typically combine file encryption with the threat of publishing stolen data to pressure victims. Public records show similar actors have targeted entities across multiple sectors in recent years, often using initial access obtained through phishing, remote-desktop exposures, or supply-chain weaknesses.

The listing of Raise the Bottom constitutes the group’s claim of responsibility. No independent confirmation of the data theft or its scope has been reported. Such claims are sometimes disputed by victims or later found to involve limited or fabricated evidence.

Raise the Bottom and its sector

Raise the Bottom provides outpatient treatment for opioid use disorder to residents of Idaho. Its programs combine medication-assisted treatment with counseling and family involvement. Organizations in this sector routinely maintain records that include patient contact information, treatment histories, insurance details, and internal administrative files.

Healthcare and behavioral-health providers have faced repeated ransomware activity because their systems often contain data that retains value on illicit markets and because service continuity is critical to patient care. A disruption or exposure at one such provider can affect individuals already navigating recovery and ongoing medical oversight.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific file types, patient records, or financial data has been released. Organizations of this kind commonly store treatment notes, appointment schedules, billing information, and staff communications, yet the precise contents of the exfiltrated material remain unconfirmed.

Without an official statement from Raise the Bottom or a verified data sample, the exact categories of personal or clinical information cannot be established.

What's at stake

Individuals whose information appears in treatment-center records may face risks of identity misuse, targeted fraud, or unwanted disclosure of sensitive health details. Even when the scale is unknown, the presence of any exfiltrated files increases the chance that personal data could circulate beyond the original breach.

For the organization, the incident adds operational costs for investigation, potential regulatory review, and restoration of systems. Patients and staff may experience uncertainty while the scope of exposure is clarified.

What to do if you're exposed

Anyone who has received services from Raise the Bottom or similar providers should monitor financial accounts and credit reports for unusual activity. Enabling multi-factor authentication on patient portals and email accounts reduces the chance of further unauthorized access.

Readers can run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published datasets. Organizations in this sector are also advised to review access controls and logging practices after any confirmed incident.

AICompiled with AI assistance from public sources and published under our editorial standards.