Friendship House Listed by medusa Ransomware Group

On February 25, 2025, the Medusa ransomware group added Friendship House, a Nebraska mental health and substance abuse treatment clinic, to its public leak site, claiming that internal files had been exfiltrated during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the clinic, located at 406 W Koenig St, Grand Island, Nebraska, provides both outpatient and inpatient services. It operates with a small staff of nine employees. The Medusa leak page states that internal files were stolen prior to encryption and are now available for download by anyone who visits the onion site. No exact count of affected individuals has been released, and it remains unclear precisely which categories of records were taken. Available reporting describes the incident as a classic ransomware double-extortion case in which the threat actors first demand payment to prevent publication, then list the victim when negotiations fail or deadlines pass.

Why This Matters for You and Your Family

When a healthcare provider like Friendship House is breached, the people most directly affected are current and former patients, their spouses, and dependent children whose personal and medical information may now sit in an easily accessible criminal archive. Internal files often contain names, dates of birth, Social Security numbers, insurance details, treatment records, addresses, and phone numbers. Once exposed, this data can be used for identity theft, insurance fraud, or targeted phishing that feels personal because attackers know your family’s mental-health or addiction history. Even if you were not a direct patient, family members sometimes share addresses or emergency contacts, creating overlap that pulls you into the breach.

The Doxxing and Identity-Chain Implications

Stolen internal files rarely stay isolated. Attackers and data brokers routinely combine them with other leaks to build detailed profiles. A single spreadsheet linking your name, phone number, and email can be cross-referenced with gaming accounts, social-media handles, or school records belonging to your children. This creates an identity chain that turns one breach into repeated harassment, doxxing, or account takeovers. Credential leaks like this one frequently cascade into gaming platforms because kids often reuse simplified passwords or email addresses tied to family accounts. Public reporting shows these chains accelerate when ransomware groups publish raw files rather than curated lists, giving any buyer immediate access to the full dataset.

Medusa’s Publicly Known Track Record

Public reporting attributes Medusa’s emergence to mid-2021. The group has since hit hospitals, schools, municipalities, and small businesses across multiple countries. Notable prior victims include healthcare providers and local government agencies whose sensitive internal documents were posted after ransom demands went unmet. Their typical playbook begins with initial access through phishing or exploited remote desktop credentials, followed by rapid exfiltration of internal shares and databases. Extortion follows a two-stage pattern: first a ransom demand with a short deadline, then public listing on their leak site with samples and countdown timers if payment is not received. The group operates a leak site on the dark web where full archives are sometimes released for free after the deadline expires.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to the Friendship House breach.
• Rotate the password used at Friendship House anywhere it is reused, enable 2FA through an authenticator app instead of text messages, and review account activity for unexpected logins.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into takeovers and doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts and talking with your family about safe password habits.

The Friendship House breach is a reminder that healthcare providers of any size can become targets, and the data they hold travels farther and faster than most families expect. Taking concrete steps now limits how far this incident can reach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts.