sehma.com Listed by threeam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and related care networks, where operational data and patient-related records create pressure for payment and where disruption can affect continuity of service. Listings on criminal leak sites remain a common way these actors publicise claimed intrusions, even when independent confirmation is limited.

On or around 1 February 2025, the organisation behind sehma.com was listed by the ransomware group threeam. Public reporting describes the incident as involving internal files said to have been exfiltrated in a ransomware attack. The number of people affected is unknown, and many operational details remain undisclosed. For patients, staff, and partners of a home-health network, any such claim matters because of the sensitivity of the sector and the potential for secondary misuse of stolen material.

Breaking down the breach

According to available reporting, sehma.com was listed by the threeam ransomware group, with the report dated 1 February 2025. The summarised description states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected. Timing of the initial intrusion, the precise method of access, the volume of data taken, and whether systems were encrypted or operations interrupted are not detailed in the disclosed facts. The listing itself is a claim by the group rather than an independently verified confirmation of every asserted detail.

What is known is therefore narrow: a named organisation in the home-health sector appeared on a ransomware group’s leak-site activity, associated with alleged exfiltration of internal files. Beyond that characterisation, public detail is limited.

The group behind it: threeam

threeam is a ransomware operation that has been observed conducting double-extortion style campaigns: encrypting or threatening systems while also claiming to steal data and threatening to publish it if demands are not met. Like other groups in this category, it has used dedicated leak sites to name victims and, in some cases, to stage purported samples or larger dumps. Public tracking of the group has associated it with opportunistic targeting across multiple industries rather than a single exclusive sector focus.

In this instance, the group claims sehma.com as a victim and associates the listing with exfiltration of internal files. No further statements, ransom demands, or published file inventories specific to this victim are included in the facts provided here. Readers should treat the leak-site listing as an unverified claim until corroborated by the organisation, regulators, or other independent sources.

sehma.com and its sector

SEHMA is described as a home health care provider network specialising in home health nursing, high-tech infusion, durable medical equipment, and diagnostic services. Organisations of this type coordinate care outside traditional hospital settings, often managing schedules, clinical documentation, equipment logistics, and communications among clinicians, patients, and families. Continuity of care and patient outcomes are central to their stated mission.

A breach claim against such a network is consequential because home-health providers typically sit at the intersection of clinical, administrative, and supply-chain data. Even when only “internal files” are named, the sector’s reliance on accurate records and trusted communications means that any successful intrusion can raise questions about operational resilience and the protection of people who depend on in-home services.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. Exact file inventories, categories of personal or clinical data, and whether patient, employee, or partner records were included are not disclosed. Organisations in home health care commonly hold or process information such as patient contact and demographic details, clinical notes and care plans, insurance and billing records, staff credentials and schedules, and vendor or equipment-related documentation. That typical profile does not confirm what was taken in this incident.

Because the public description stops at “internal files,” the precise contents remain unconfirmed. Affected individuals and partners should not assume either that highly sensitive clinical data was included or that it was spared; only further disclosure from the organisation or competent authorities can clarify the scope.

The real-world impact

For people whose information may have been among internal files, risks include phishing or social-engineering attempts that reference real care relationships, identity misuse if identifiers were present, and longer-term uncertainty about what was exposed. For the organisation, consequences can include operational distraction, costs of investigation and notification, potential regulatory scrutiny common to healthcare-adjacent entities, and erosion of trust among patients and referral partners.

None of these outcomes is automatic; they depend on what was actually taken and how it is later used. The absence of a published count of affected people and of a detailed data inventory makes it harder for individuals to assess personal exposure without further official communication.

If your data was in this claimed breach

If you are a patient, caregiver, employee, or partner connected to sehma.com or its network, treat the threeam listing as a signal to take basic protective steps while awaiting any formal notices. Practical first actions include:

• Watch for unexpected emails, calls, or messages that reference home-health care, appointments, equipment, or insurance; verify through known official channels before responding or clicking.
• Review account passwords related to healthcare portals, email, and financial services; use unique passwords and enable multi-factor authentication where available.
• Monitor financial and insurance statements for unfamiliar activity and consider a fraud alert with credit bureaus if you believe identifiers may have been involved.
• Retain any official breach notification you receive; it may specify what data types were confirmed and what support is offered.
• Run a free exposure scan of your email address to check whether your information has already appeared in known breach datasets, which can help you prioritise further monitoring.

Public detail on this incident remains limited. Further clarity will depend on disclosures from the organisation, law enforcement, or regulators rather than on claims made solely on a ransomware leak site.

AICompiled with AI assistance from public sources and published under our editorial standards.