Southern Indiana Radiological Associates Listed by Storm Ransomware Group

On August 06, 2026, the Storm ransomware group listed Southern Indiana Radiological Associates on its leak site, claiming the medical imaging provider was hit by a ransomware attack and that internal files had been exfiltrated. The organization has not, as of this writing, issued any public confirmation or breach notification.

Leak Site Claim Details

The Storm leak-site listing states that Southern Indiana Radiological Associates suffered a ransomware attack in which internal files were exfiltrated. The entry does not specify the volume of data taken, the exact types of records involved, or any ransom demand. According to the listing on RansomLook, the group has published a sample of the allegedly stolen material as proof of compromise. Because the primary disclosure comes solely from the threat actor’s own leak site rather than a company statement, regulator filing, or federal agency notice, this remains an unconfirmed claim. Southern Indiana Radiological Associates has not publicly acknowledged the incident or provided details on what, if anything, was taken.

Why This Matters for You and Your Family

When a radiology practice is targeted, the potential exposure reaches far beyond the company. Patients who have undergone CT scans, MRIs, PET scans, mammograms, or other imaging at Southern Indiana Radiological Associates may have sensitive medical records, insurance details, Social Security numbers, dates of birth, home addresses, and contact information stored in the affected systems. Even though the exact data set is unknown, medical imaging providers routinely hold protected health information that, once leaked, can be used for identity theft, insurance fraud, or targeted scams. If your imaging records from Bloomington or surrounding Southern Indiana facilities are among those claimed to have been taken, your family’s private health and financial details could already be circulating among criminals.

Doxxing and Identity-Chain Risks

Medical breaches create particularly dangerous doxxing chains. A leaked patient file often contains your name, address, date of birth, phone number, and sometimes employer or spouse information. These details can be cross-referenced with credential leaks from other services to map your full online identity. Children’s gaming accounts frequently reuse the same family email or password, allowing attackers to pivot from a parent’s medical record to a minor’s Discord, Roblox, or Steam profile, exposing the entire household. The combination of health data and personal identifiers makes targeted phishing, medical identity theft, and physical stalking significantly more likely.

Storm Ransomware Group Track Record

Public reporting attributes Storm as a ransomware operation that emerged in late 2024. The group is known for double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data for later public release if ransom is not paid. Prior victims have included healthcare providers, municipalities, and mid-sized businesses. Storm typically gains initial access through phishing, remote desktop protocol brute-force attacks, or exploited vulnerabilities in internet-facing applications. Once inside, the group focuses on locating and stealing sensitive folders before deploying ransomware. Their leak site is used both to pressure victims and to auction or publish data when negotiations fail. The exact success rate and total number of victims remain unclear, but healthcare organizations appear repeatedly in their claimed targets.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, usernames, and real-world identity so you can see exactly what this claim may have exposed.
• Enable continuous DoxxScan monitoring across 13.1 billion breach records and more than 100 platforms; the next time your information surfaces it will be caught within hours rather than months.
• Rotate any password you have ever used when registering for imaging appointments or patient portals, and secure every reused account with 2FA through an authenticator app instead of SMS.
• Let remediation specialists handle takedown requests for any exposed personal records that appear on data broker sites or underground forums.
• Note that a leaked home address places everyone living at that location at risk; your own removal requests are what ultimately remove that address from public circulation.

The incident underscores how quickly a single unconfirmed ransomware claim can place thousands of patients and their families in the crosshairs of identity thieves. Acting immediately on the exposure you can see and continuously monitoring for new appearances is the most practical defense. DoxxScan by GalaxyWarden combines continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists to help you close those exposure gaps yourself.