Mid South Pulmonary & Sleep Specialists Listed by Anubis Ransomware Group

On November 28, 2025, the Anubis ransomware group listed Mid South Pulmonary & Sleep Specialists on its leak site and began publishing what it claims are the Tennessee medical practice’s internal files, exposing patient data in a ransomware attack.

What Public Reporting Shows

Public reporting indicates the healthcare provider’s systems were compromised and data was exfiltrated before encryption or during the attack process. The Anubis leak portal now hosts samples of the stolen material, though the exact number of patients affected remains unknown. Available reporting describes the exposed information as internal files containing patient records typical of a pulmonary and sleep-medicine practice, including names, medical histories, treatment details, and associated personal identifiers.

November 28, 2025 marks the date the group added Mid South Pulmonary & Sleep Specialists to its public shaming page. No evidence has surfaced showing the attackers contacted the clinic privately before publication, which aligns with Anubis’s observed pattern of rapid escalation to public leaks.

Why This Matters for You and Your Family

If you or anyone in your household has ever been a patient at Mid South Pulmonary & Sleep Specialists, your medical information may now sit in a criminal database. Medical records contain some of the most sensitive details about you: diagnoses, test results, medications, and insurance information. Once stolen, this data can fuel identity theft, insurance fraud, or blackmail for years.

Patient data breach incidents like this one affect ordinary families who simply sought care for breathing disorders or sleep apnea. You do not need to be high-profile for the information to be valuable to criminals; a Social Security number paired with a medical history is enough to open accounts, file false tax returns, or impersonate you at hospitals.

The Doxxing and Identity-Chain Implications

Medical breaches rarely stop at the clinic’s doors. Attackers frequently cross-reference leaked patient emails, phone numbers, and addresses against other stolen datasets. This creates an identity chain that links your doctor visits to your online accounts, children’s school records, and family addresses. Credential leaks from one breach often cascade into gaming-platform takeovers, especially when parents reuse passwords or when children use family email addresses for Roblox, Fortnite, or other services.

Once criminals map these connections, they can move from simple data sales to targeted doxxing, harassment, or extortion. A single exposed medical file can become the anchor that ties your real identity to dozens of online handles.

Anubis Ransomware Group Track Record

Public reporting attributes the Anubis ransomware operation to a group that emerged in 2024. The gang has targeted healthcare providers, municipalities, and small-to-medium businesses across multiple countries. Notable prior victims include other medical practices and local government entities whose data appeared on the same leak site now hosting Mid South Pulmonary & Sleep Specialists’ files.

The group’s typical playbook involves initial access through phishing or exploited remote desktop credentials, followed by claimed exfiltration of sensitive files. They then demand ransom and, if unpaid, publish samples or full datasets on their onion-site portal. Extortion tactics combine data leaks with threats to notify patients or regulators, increasing pressure on victims to pay.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in this or earlier breaches.
• Rotate any password you ever used at Mid South Pulmonary & Sleep Specialists and enable 2FA with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails used for medical paperwork.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing accounts and monitoring statements.

The reality is that medical providers will continue to be prime targets, and your family’s information may surface again in future incidents. Starting with concrete steps today limits how far criminals can travel down the identity chain created by this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.