Cookeville Regional Medical Center Listed by rhysida Ransomware Group

On July 13, 2025, Cookeville Regional Medical Center appeared on the leak site of the rhysida ransomware group. The hospital confirmed that internal files had been exfiltrated during a ransomware attack, though the exact number of patients and staff whose records were taken remains unknown.

What's Publicly Reported from Reporting

Public reporting indicates that rhysida listed Cookeville Regional Medical Center and began publishing samples of stolen data. The exposed material consists of internal files rather than a single structured database. No precise count of affected individuals has been released, and the hospital has not issued a detailed breach notification specifying the categories of information involved. Available reporting describes the incident as a classic ransomware deployment in which attackers gained access, exfiltrated data, and then encrypted systems before demanding payment.

Why This Matters for You and Your Family

When a local hospital’s internal files are stolen, the people most at risk are ordinary patients and their families. Medical records often contain names, dates of birth, Social Security numbers, addresses, insurance details, and clinical information. Once these records leave the hospital’s control, they can be sold, posted, or used to commit identity theft, file fraudulent tax returns, or open accounts in your name. Even if your own records are not among the first samples shown, the uncertainty creates lasting worry for anyone who has visited Cookeville Regional Medical Center or had a family member treated there.

The Doxxing and Identity-Chain Implications

Medical data rarely stays isolated. A single leaked email or phone number can be correlated with gaming usernames, social-media handles, and family addresses. Attackers follow these links to build complete profiles, then move from identity theft to doxxing, account takeovers, or harassment. Credential leaks like this one frequently cascade into gaming account compromises because the same passwords or recovery emails are reused across services. Children’s gaming accounts are especially vulnerable because parents often link them to household emails or phone numbers that appear in medical files.

Rhysida’s Publicly Known Track Record

Public reporting attributes rhysida with emerging in 2023. The group has targeted hospitals, municipalities, and private companies across multiple countries. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration, encryption of victim systems, and extortion demands backed by the threat of gradual data leaks on its onion site. The group’s name is deliberately stylized in lowercase, making it easy to follow on public ransomware trackers.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Cookeville records.
• Rotate any password you ever used at Cookeville Regional Medical Center or associated patient portals, and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that could be reached through the same leaked address or email.
• Let remediation specialists handle takedown requests and broker removals for you while you focus on securing accounts and watching for suspicious activity on credit reports.

The incident at Cookeville Regional Medical Center is a reminder that healthcare providers remain prime targets and that one breach can quietly connect to many parts of your digital life. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.