Morrison Community Hospital FULL HUGE LEAK + BONUS Listed by alphv Ransomware Group

On October 28, 2023, Morrison Community Hospital appeared on the leak site operated by the alphv ransomware group, where attackers posted what they described as a full huge leak plus bonus material stolen from the Illinois-based Critical Access Hospital.

Details from the Leak Listing

The alphv leak site entry states that internal files were exfiltrated during a ransomware attack on Morrison Community Hospital. The listing does not quantify how many records were taken, nor does it specify the exact file types or categories of data involved. It simply presents the hospital as a victim and offers the stolen material for download to anyone who visits the onion address. The disclosure indicates the data was obtained after the hospital apparently declined or failed to meet the group’s extortion demands. No patient count, employee count, or specific data fields such as names, Social Security numbers, or medical histories are detailed in the listing itself.

Why This Matters for You and Your Family

If you or any member of your family has ever received care at Morrison Community Hospital, your personal and medical information may now sit in an easily accessible criminal archive. Internal files exfiltrated in a ransomware attack often contain exactly the details adversaries need to open accounts, file fraudulent tax returns, or impersonate you with insurers. Even when exact record counts remain unknown, the exposure of hospital data carries long-term risk because medical identities are valuable on underground markets and difficult to correct once misused. For families in the hospital’s service area, this single breach can affect multiple generations who have sought treatment there over the years.

The Doxxing and Identity-Chain Risks

Stolen internal hospital files frequently link names, dates of birth, addresses, phone numbers, and insurance details. Adversaries routinely combine this information with credential leaks from other breaches to build complete identity chains. A single reused password found in the Morrison materials can hand attackers access to your email, banking, or government accounts. The same data can be used to dox family members by mapping household connections or to target children whose information appears in a parent’s medical record. These chains accelerate because one breach becomes the foundation for the next, turning a hospital visit years ago into active identity theft today.

Alphv’s Known Track Record

Public reporting attributes the alphv group, also known as BlackCat, with emerging in late 2021 after the shutdown of the REvil ransomware operation. The gang has since hit hospitals, municipalities, and private companies across multiple countries. Notable prior victims include large healthcare providers and technology firms whose data appeared on the same leak site. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by deployment of custom ransomware, careful exfiltration of sensitive files, and then dual extortion: demanding payment to decrypt systems and a second payment to prevent publication of the stolen data. When victims refuse, alphv posts samples and eventually the full archive, exactly as occurred with Morrison Community Hospital.

What to do

• Run a DoxxScan to map every link between your emails, phones, usernames, and real-world identity so you can see exactly what chains back to the Morrison breach.
• Rotate any password you ever used at Morrison Community Hospital or related healthcare portals and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught and acted on quickly.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become takeover targets when parent credentials surface in leaks like this one.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise consume months of your own time.

The Morrison Community Hospital breach is a reminder that healthcare providers remain prime targets and that yesterday’s patient records can become tomorrow’s identity theft fuel. Starting with a clear map of your exposed data gives you the best chance to break the chain before criminals exploit it. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential leaks.