Modoc Medical Center Listed by World Leaks Ransomware Group

On February 16, 2026, Modoc Medical Center in Alturas, California, appeared on the leak site operated by the ransomware group WorldLeaks. The listing indicates that internal files were exfiltrated during a ransomware attack on the rural healthcare provider, which serves Modoc County with emergency care, surgery, laboratory services, radiology, rehabilitation, a skilled nursing facility, and outpatient clinics.

Reported Details from Reports

Public reporting indicates the healthcare facility was listed on the WorldLeaks onion site with a reference number tying it to the incident. Available details describe the compromise as a ransomware event in which attackers gained access, exfiltrated internal files, and later published the organization on their leak portal. The exact number of individuals whose records were involved remains unknown, and the specific types of documents posted have not been independently verified beyond the group's claim of stolen internal files. Modoc Medical Center has not yet issued a public statement detailing the timeline or scope.

Why This Matters for You and Your Family

When a local hospital or clinic is hit, the people affected are usually patients, current and former employees, and their family members whose addresses, dates of birth, Social Security numbers, insurance details, or medical records may have been stored in the compromised systems. Healthcare data is especially sensitive because it can be used for identity theft, insurance fraud, or blackmail. Even if you live in a small county like Modoc, once files leave the organization's control they can circulate on dark-web forums for years. Your family's medical history, billing records, and contact information become commodities that criminals can exploit long after the initial news fades.

The Doxxing and Identity-Chain Risks

Stolen internal files from healthcare providers frequently contain not only clinical notes but also employee directories, vendor contracts, and patient contact lists. These records allow attackers to link an email address or phone number found in one breach to usernames on social media, gaming platforms, or shopping sites. The result is an identity chain that can lead to doxxing, account takeovers, or targeted scams. Credential leaks like this one often cascade into gaming account compromises, especially for children and teenagers who reuse passwords or email addresses tied to family medical accounts. Public reporting shows these chains frequently expand from a single breach into broader exposure across dozens of online services.