Kootenai Health was listed on the leak site of the threeam ransomware group on February 22, 2024. The Idaho-based hospital, which serves patients across Idaho, Montana, and Eastern Washington, is claimed to have had internal files exfiltrated during a ransomware attack. The disclosure indicates that data was stolen but does not specify the volume of records affected or the exact types of information involved.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch kh.org
Get alerted the next time kh.org files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about kh.org’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak Site
The primary disclosure on the threeam leak site states that Kootenai Health, founded in 1966 and headquartered in Coeur d’Alene, suffered a ransomware incident resulting in the theft of internal files. The listing does not quantify affected records, name specific data types such as patient records or employee information, or reveal any ransom demand. It simply states that exfiltrated material is available on the group’s dark-web portal. Public reporting on threeam ransomware incidents consistently shows that when a victim appears on the leak site, it means negotiations have failed and the attackers intend to publish or sell the stolen data.
February 22, 2024 marks the date the hospital was first publicly listed by the group. The leak site uses an onion address and is tracked by ransomware monitoring services such as ransomware.live.
Why This Matters for You and Your Family
If you or any member of your family has received care at Kootenai Health, your personal information may now sit in an attacker-controlled archive. Hospitals hold names, dates of birth, Social Security numbers, medical histories, insurance details, and contact information. Even when the disclosure does not list exact data types, the nature of “internal files” from a healthcare provider typically includes these sensitive elements. Exposure puts you at immediate risk of identity theft, fraudulent tax filings, insurance scams, and targeted phishing campaigns that reference your actual medical visits.