Group Health Cooperative - Rev 500kk Listed by BlackSuit Ransomware Group

On January 25, 2024, Group Health Cooperative appeared on the leak site operated by the Blacksuit ransomware group, listed under the identifier “Rev 500kk.” The posting signals that patient records, employee personal information, and internal financial documents were allegedly exfiltrated during a ransomware incident. Anyone who has received care at Group Health Cooperative or worked there may now face long-term exposure of highly sensitive medical and identity data.

Details in the Leak-Site Posting

The Blacksuit leak site states that internal files were taken during a ransomware attack. The listing does not quantify the exact number of affected records. It describes patient and member data including MRN numbers, SSN numbers, patient ID, DOB, telephone, email, residential addresses, visit information, medical history, patient forms, clinic notes, diagnostic scans, laboratory test results, and additional clinical details. Financial documents listed include balance sheets, budgets, profit-and-loss reports, audits, statements, transaction records, cash-flow analyses, and presentations. Employee records mentioned contain SSNs, residential addresses, dates of birth, email addresses, license numbers, and scanned personal documents. The disclosure indicates the data has been exfiltrated; it does not state whether the files have been fully published or remain behind a paywall.

Why This Matters for You and Your Family

Medical data combined with Social Security numbers, addresses, and financial records creates a high-value target for identity thieves. A single breach like this can supply everything needed to file fraudulent tax returns, open accounts in your name, or impersonate you during medical visits. Because the exposed information includes clinical notes and laboratory results, there is also risk of sensitive health conditions being used for blackmail or sold on underground markets. If you or your children have been patients, your household could be linked across multiple data sets for years to come.

Doxxing and Identity-Chain Risks

Once SSNs, emails, and addresses are public, attackers can correlate them with usernames found in other breaches to build complete identity profiles. These chains often extend to gaming accounts, where children’s usernames and shared family passwords become entry points for further compromise. A single leaked email from this incident can unlock social-media accounts, password-reset flows, and ultimately physical addresses or phone numbers that enable swatting or stalking. The persistent nature of ransomware leak sites means the data may circulate long after the initial posting, increasing the chance that your information surfaces in doxxing databases or fraud kits.