Modoc Medical Center Listed by worldleaks Ransomware Group

On February 16, 2026, Modoc Medical Center in Alturas, California, appeared on the leak site operated by the ransomware group WorldLeaks. The listing indicates that internal files were exfiltrated during a ransomware attack on the rural healthcare provider, which serves Modoc County with emergency care, surgery, laboratory services, radiology, rehabilitation, a skilled nursing facility, and outpatient clinics.

Reported Details from Reports

Public reporting indicates the healthcare facility was listed on the WorldLeaks onion site with a reference number tying it to the incident. Available details describe the compromise as a ransomware event in which attackers gained access, exfiltrated internal files, and later published the organization on their leak portal. The exact number of individuals whose records were involved remains unknown, and the specific types of documents posted have not been independently verified beyond the group's claim of stolen internal files. Modoc Medical Center has not yet issued a public statement detailing the timeline or scope.

Why This Matters for You and Your Family

When a local hospital or clinic is hit, the people affected are usually patients, current and former employees, and their family members whose addresses, dates of birth, Social Security numbers, insurance details, or medical records may have been stored in the compromised systems. Healthcare data is especially sensitive because it can be used for identity theft, insurance fraud, or blackmail. Even if you live in a small county like Modoc, once files leave the organization's control they can circulate on dark-web forums for years. Your family's medical history, billing records, and contact information become commodities that criminals can exploit long after the initial news fades.

The Doxxing and Identity-Chain Risks

Stolen internal files from healthcare providers frequently contain not only clinical notes but also employee directories, vendor contracts, and patient contact lists. These records allow attackers to link an email address or phone number found in one breach to usernames on social media, gaming platforms, or shopping sites. The result is an identity chain that can lead to doxxing, account takeovers, or targeted scams. Credential leaks like this one often cascade into gaming account compromises, especially for children and teenagers who reuse passwords or email addresses tied to family medical accounts. Public reporting shows these chains frequently expand from a single breach into broader exposure across dozens of online services.

WorldLeaks Group's Known Activity

Public reporting attributes the attack to the ransomware group known as WorldLeaks. The group emerged in recent years and has listed healthcare organizations, municipalities, and small businesses on its leak site after failing to receive ransom payments. Its typical playbook involves initial access through phishing or unpatched remote desktop services, followed by data exfiltration and encryption of systems. If the victim does not pay, WorldLeaks publishes samples or full archives on its onion site and sometimes pressures the organization through emails to executives or media outlets. Exact success rates and prior victim counts fluctuate in open-source tracking, but healthcare providers have appeared repeatedly among its targets.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at Modoc Medical Center or related clinic portals anywhere else it is reused, and switch to 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children's gaming accounts, which often become the next link in doxxing chains when healthcare credentials are exposed.
• Let remediation specialists handle the follow-up work, including sending takedown requests to data brokers and monitoring for misuse of any leaked medical or personal documents.

The incident at Modoc Medical Center shows how quickly a local healthcare provider's data can become public and fuel larger identity crimes. Taking concrete steps now limits how far attackers can travel down the chain that begins with this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with coverage that protects your entire household including children's gaming accounts. Start your DoxxScan trial today to close the gaps this attack has opened.