Hospice Savannah Hit by CMD Ransomware
Nonprofit hospice care provider Hospice Savannah (hospicesavannah.org) in Georgia was listed as a victim by the CMD ransomware group. The claim was publicly reported on ransomware tracking sites on May 28-29, 2026. Specific data volume and types exposed were not detailed in initial reports.
- credentials
Hospice Savannah, a nonprofit hospice care provider in Georgia, was listed as a victim by the CMD ransomware group, with the claim appearing on ransomware tracking sites on May 28-29, 2026. The incident exposed credentials, though initial public reporting does not specify the volume of records or exact data types involved. Patients, employees, and anyone whose login details were stored by the organization may be affected.
Available reporting describes the breach as confirmed through the attackers’ own leak site, a common tactic used by ransomware operators to pressure victims. Public records from Breachsense and Ransomware.live indicate that Hospice Savannah’s systems were compromised, with CMD claiming successful exfiltration of data. No detailed breach size has been released, and the organization has not yet issued a formal public notification detailing the scope. Industry research from sources such as DoxxScan™ continuous monitoring indicates that healthcare organizations remain frequent targets because medical records and associated credentials hold long-term value on underground markets.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records (including this breach) in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
