Spindletop Center Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Spindletop Center, a non-profit healthcare provider, was listed by the rhysida ransomware group on October 30, 2025. Public reporting indicates that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown.

The listing itself is a claim by the group rather than independent confirmation of every detail. For an organization that handles behavioral health, intellectual and developmental disability services, and substance-use recovery, any exposure of patient information carries clear consequences for privacy and safety.

Breaking down the breach

According to available records, Spindletop Center appeared on rhysida’s leak site on October 30, 2025. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. No further public detail has been released on the precise method of initial access, the duration of the intrusion, the total volume of data taken, or whether systems were encrypted in addition to the theft of files.

The number of individuals whose information may have been involved is listed as unknown. No ransom demand amount, negotiation timeline, or confirmation of data publication beyond the listing itself has been disclosed in the source material. All specifics beyond the listing date, the attribution to rhysida, and the statement that internal files were allegedly exfiltrated remain unconfirmed in public reporting.

Who is rhysida?

Rhysida is a ransomware operation that became publicly active in 2023. The group typically follows a double-extortion model: it steals data, encrypts systems when possible, and threatens to publish the stolen material on a dedicated leak site if payment is not made. Rhysida has been observed targeting organizations across multiple sectors, including healthcare, education, government, and manufacturing.

Public technical reporting describes common tactics such as phishing, exploitation of known vulnerabilities, and the use of living-off-the-land tools once inside a network. The group operates a Tor-based leak site where it posts victim names and, in some cases, sample files. Listings on that site are claims by the operators; independent verification of the full contents or the success of any attack is not automatic. No statements attributed specifically to rhysida about Spindletop Center beyond the listing itself appear in the available facts.

Who is Spindletop Center?

Spindletop Center is a non-profit healthcare organization that provides behavioral healthcare services, programs for individuals with intellectual and developmental disabilities, and substance-use recovery support. Organizations of this type routinely maintain clinical records, demographic information, treatment histories, and related administrative data necessary to deliver care and coordinate services.

Because the center works with populations that often face heightened stigma or vulnerability, the sensitivity of the information it holds is high. A ransomware incident involving such an entity raises concerns not only about operational disruption but also about the potential misuse of medical and personal details that patients and clients entrust to the organization.

What was likely exposed

The facts state that internal files were exfiltrated in the ransomware attack. The reported summary associated with the incident references more than 100,000 patient records and lists categories that can appear in such files. Exact contents and the precise number of affected individuals remain unconfirmed, as the official count of people affected is unknown. Organizations providing behavioral health and disability services typically hold records that may include:

• Names, addresses, and phone numbers
• Social Security numbers and other government identifiers such as passport numbers
• Diagnoses, medical history, and treatment notes
• Insurance and billing information
• Emergency-contact and demographic details

Until Spindletop Center or independent investigators release a verified inventory, these categories should be treated as the types of data commonly present rather than as a confirmed list of what left the network.

Why it matters

Exposure of behavioral-health and disability-related records can enable identity theft, financial fraud, and targeted social-engineering attempts. Medical diagnoses and treatment histories are particularly sensitive; their misuse can lead to discrimination, blackmail, or emotional harm. For people receiving substance-use or intellectual-disability services, the stigma attached to such information can amplify the personal impact.

For the organization itself, a ransomware event can interrupt care delivery, create regulatory notification obligations, and require costly forensic and recovery work. Even when the full scope is still being assessed, the combination of clinical data and personal identifiers creates lasting risk for anyone whose information was stored in the affected systems.

Were you affected?

If you have received services from Spindletop Center, monitor financial accounts and credit reports for unusual activity and consider placing a fraud alert with the major credit bureaus. Be cautious of unsolicited calls or messages that reference your medical history or personal details. Keep records of any official breach notifications you receive from the organization.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Doing so provides an additional, independent signal while waiting for any formal notices that may still be forthcoming.

AICompiled with AI assistance from public sources and published under our editorial standards.