Southern Illinois Dermatology Listed by insomnia Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Southern Illinois Dermatology has been named by the insomnia ransomware group as the target of a recent attack, with internal files confirmed to have been exfiltrated. The incident was disclosed on November 28, 2025; individuals are advised to check any notices from the practice and to monitor their accounts for unusual activity.
Inside the incident
Public reporting on the event is limited to the group’s leak-site listing. No official statement from Southern Illinois Dermatology has been issued, and no timeline for the intrusion, method of initial access, or volume of data has been disclosed. The listing itself constitutes the primary public record at this stage.
The group behind it: insomnia
Insomnia is a ransomware operation that follows the double-extortion model common among contemporary groups. It typically encrypts systems and then publishes or threatens to publish stolen files on a dedicated leak site when ransom demands are not met. The group has appeared in multiple public listings involving healthcare and other sectors in recent years. In this case, the group claims Southern Illinois Dermatology is among its victims; that claim has not been independently verified by the organization or by law-enforcement statements released to date.
About Southern Illinois Dermatology
Southern Illinois Dermatology was founded in 1996 by board-certified dermatologist Dr. Ted G. Van Acker. It has expanded from a single office to 15 locations and provides general, surgical, cosmetic dermatology services along with advanced laser treatments. Medical practices of this type routinely maintain electronic health records that include patient identifiers, clinical notes, insurance information, and appointment histories.
The information in question
The only detail released so far is that internal files were allegedly exfiltrated. No inventory of specific data categories—such as names, dates of birth, Social Security numbers, medical diagnoses, or payment card data—has been published by either the group or the practice. Because the exact contents remain undisclosed, it is not possible to state which records, if any, were taken.
The real-world impact
Healthcare organizations hold information that can be used for identity theft, insurance fraud, or targeted scams. When files are removed from a medical practice, patients may face uncertainty about whether their records have been copied and how those records could be misused over time. For the organization, the incident adds operational, regulatory, and reputational considerations typical of any ransomware event involving protected health information.
If your data was in this claimed breach
Individuals who are patients of Southern Illinois Dermatology can contact the practice directly to ask what, if any, information was affected and what steps the organization is taking. Standard protective measures include reviewing credit reports, monitoring insurance explanations of benefits for unexpected claims, and placing fraud alerts with credit bureaus if warranted. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Optimum Health Institute Listed by insomnia Ransomware GroupSchureMed Listed by insomnia Ransomware GroupTri-Cities Gastroenterology Listed by insomnia Ransomware GroupFlint Hills Dialysis Listed by insomnia Ransomware GroupLatest breaches
Publicly posted by insomnia — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.