Tri-Cities Gastroenterology Listed by insomnia Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Tri-Cities Gastroenterology was listed by the insomnia ransomware group on December 16, 2025. The listing states that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and no further details on the volume or contents of the data have been made public.

Inside the incident

The only confirmed information is the date the organization appeared on the group’s listing and the statement that internal files were taken. No timeline for the intrusion, no description of the initial access method, and no indication of whether encryption occurred or ransom demands were issued have been released. The scale of the operation is also undisclosed.

The group behind it: insomnia

Insomnia is a ransomware operation that maintains a public leak site where it lists organizations from which it claims to have stolen data. Like other groups in this category, it typically gains access through common vectors such as compromised remote-access services or phishing, then exfiltrates files before deploying encryption. The listing of Tri-Cities Gastroenterology constitutes the group’s claim; independent confirmation of the theft has not been reported.

Tri-Cities Gastroenterology and its sector

Tri-Cities Gastroenterology provides digestive-care services and works with referring physicians by supplying patient information and reports. Organizations in this sector routinely maintain electronic health records, referral correspondence, scheduling systems, and billing data. A breach at such a provider can therefore touch both clinical and administrative information that is subject to regulatory protections.

What was likely exposed

The published information states only that internal files were exfiltrated. The precise categories of data contained in those files have not been disclosed. Healthcare providers of this type commonly store patient identifiers, clinical notes, laboratory results, insurance details, and staff records, but whether any or all of these were included remains unconfirmed.

What's at stake

Individuals whose information appears in the exfiltrated files face the possibility of identity theft, targeted fraud, or misuse of medical details. The organization may incur costs related to investigation, notification, and regulatory review. Because the exact scope is unknown, the full extent of these consequences cannot yet be measured.

If your data was in this claimed breach

Monitor financial and medical accounts for unusual activity and consider placing a fraud alert with credit bureaus. Review any statements or explanations issued by Tri-Cities Gastroenterology once available. Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.