On August 06, 2026, the ransomware group known as Storm listed OVP Health on its leak site, claiming the healthcare provider was hit by a ransomware attack in which internal files were exfiltrated. OVP Health, a physician-owned company operating across West Virginia, Kentucky, Ohio, and Virginia, provides emergency department staffing, hospitalist services, addiction treatment, behavioral health care, primary care, and telemedicine. As of this writing, OVP Health has not issued a public breach notification or confirmed the incident.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll email that address a link. Open it and we check it against 13.1B+ leaked records — no account needed. Continuous monitoring & alerts are part of Protection.
Leak Site Claim Details
The primary disclosure comes exclusively from the Storm ransomware group's leak site, tracked via RansomLook. According to the listing, internal files were exfiltrated during a ransomware attack. The entry does not specify the volume of data taken, the exact types of records involved, the number of patients or employees affected, or any ransom demand. Because the claim originates solely from the threat actor’s own platform and has not been corroborated by an official company statement, regulator filing, or federal disclosure, this remains an unconfirmed claim. OVP Health has not, as of this publication, publicly acknowledged the incident or notified affected individuals.
Why This Matters for You and Your Family
If you or a family member have received care at an OVP Health facility in the past 20 years, your protected health information may be at risk. Healthcare records often contain names, dates of birth, Social Security numbers, medical diagnoses, treatment histories, prescription records, and billing details. In addiction treatment and behavioral health contexts, these records can include highly sensitive information about substance abuse, mental health conditions, and family dynamics. Exposure of such data can lead to insurance fraud, identity theft, employment discrimination, or stigma. Even though the exact data set is unknown, the fact that internal files were taken from a healthcare staffing and treatment provider creates a credible risk to anyone whose records were held by the organization.
Doxxing and Identity-Chain Risks
Healthcare breaches frequently serve as the starting point for long-term doxxing chains. A single leaked medical record can link your name, address, phone number, email, and date of birth to additional accounts. Public reporting shows that attackers and data resellers routinely combine healthcare leaks with credential-stuffing results and data-broker profiles. This is especially dangerous for gaming accounts belonging to you or your children: a reused password or email from an old OVP Health patient portal can give adversaries a path to compromise those accounts, revealing real-world location data, voice chat logs, and friend networks that further enrich an identity profile. The longer sensitive health data circulates on underground markets, the higher the chance it will be used to map every digital handle back to your real identity and home address.