Southwest CARE Center Listed by Medusa Ransomware Group
If you are a patient of Southwest CARE Center, here’s what is being claimed, and what it would mean for you.
Southwest CARE Center was listed on Medusa's leak site. Medusa claims to have stolen internal data. This is the group's claim, not a confirmed finding.
On June 27, 2025, the Medusa ransomware group listed Southwest CARE Center on its leak site, claiming that internal files had been exfiltrated from the New Mexico healthcare provider known for treating HIV and Hepatitis C patients.
What Public Reporting Shows
Public reporting indicates Southwest CARE Center, founded in 1996, is the largest provider of Hepatitis C treatment in northern New Mexico and operates as a major clinical research site for both HIV and Hepatitis C studies. The organization opened an Albuquerque location in September 2015 to expand its patient-centered care model. Available reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The number of individuals whose data may have been exposed remains unknown. The Medusa group published details of the breach on its leak site, giving the organization a deadline to negotiate before further data is released.
- Every indexed leak tied to your address — all of them, named and dated
- A deeper search of collected breach data — the kinds of your information it holds, where it finds you
- What this kind of incident typically exposes
- A ten-minute lock list written for this kind of organisation
Why This Matters for You and Your Family
When a healthcare provider like Southwest CARE Center suffers a breach, the information involved often includes sensitive medical records, personal identifiers, contact details, and insurance data. If you or any member of your family has ever received treatment there, especially for HIV, Hepatitis C, or participated in clinical research, your private health information could now sit on a criminal leak site. Medical data is particularly dangerous because it can be used for identity theft, insurance fraud, blackmail, or to target vulnerable family members. Even if your name is not yet public, the simple fact that the files were allegedly stolen means you must assume the risk has begun.
The Doxxing and Identity-Chain Implications
Stolen internal files frequently contain more than clinical notes. They can include email addresses, phone numbers, dates of birth, addresses, and sometimes names of household members. Criminals chain these pieces together with data from other breaches to build complete profiles. A single leaked email can lead to compromised accounts across dozens of services. This is especially true for gaming accounts used by you or your children, where usernames and passwords reused from healthcare portals become entry points for doxxing, swatting, or further extortion. Once the chain starts, it is difficult to stop without deliberate, ongoing effort.
Medusa Group's Publicly Known Track Record
Public reporting attributes Medusa with emerging in 2021 as a ransomware operation that combines double-extortion tactics with data leak sites. The group has targeted hospitals, schools, and other healthcare organizations in prior attacks. Its typical playbook involves initial access through compromised credentials or vulnerabilities, followed by claimed exfiltration of sensitive files, encryption of systems where possible, and then public shaming on its leak site with countdown deadlines to pressure victims into payment. Medusa routinely posts samples of stolen data to prove possession and escalates by threatening to sell or publish the full archive.
What to do
- Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to the Southwest CARE Center breach.
- Rotate any password you ever used at Southwest CARE Center or any healthcare provider, then enable 2FA through an authenticator app on every account where that password was reused.
- Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed within hours rather than months.
- Cover your entire household with DoxxScan family protection, which extends to dependents and children's gaming accounts that often chain back to the same addresses and emails.
- Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or spend weeks chasing removal notices.
The Southwest CARE Center breach is a clear reminder that healthcare data leaks continue to expose ordinary families to long-term identity and privacy risks. Taking concrete steps now can limit the damage before criminals connect the dots. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts vulnerable to credential-stuffing attacks that follow incidents like this one.
What the free scan actually returns
Found on people-search siteswe remove these
These listings are live, public, and legal to remove — and removing them is what we do.
Found in breach recordsverifiedreported — unverified
Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.
Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.
