Southwest CARE Center Listed by medusa Ransomware Group

On June 27, 2025, the Medusa ransomware group listed Southwest CARE Center on its leak site, claiming that internal files had been exfiltrated from the New Mexico healthcare provider known for treating HIV and Hepatitis C patients.

What's Publicly Reported from Reporting

Public reporting indicates Southwest CARE Center, founded in 1996, is the largest provider of Hepatitis C treatment in northern New Mexico and operates as a major clinical research site for both HIV and Hepatitis C studies. The organization opened an Albuquerque location in September 2015 to expand its patient-centered care model. Available reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The number of individuals whose data may have been exposed remains unknown. The Medusa group published details of the breach on its leak site, giving the organization a deadline to negotiate before further data is released.

Why This Matters for You and Your Family

When a healthcare provider like Southwest CARE Center suffers a breach, the information involved often includes sensitive medical records, personal identifiers, contact details, and insurance data. If you or any member of your family has ever received treatment there, especially for HIV, Hepatitis C, or participated in clinical research, your private health information could now sit on a criminal leak site. Medical data is particularly dangerous because it can be used for identity theft, insurance fraud, blackmail, or to target vulnerable family members. Even if your name is not yet public, the simple fact that the files were allegedly stolen means you must assume the risk has begun.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain more than clinical notes. They can include email addresses, phone numbers, dates of birth, addresses, and sometimes names of household members. Criminals chain these pieces together with data from other breaches to build complete profiles. A single leaked email can lead to compromised accounts across dozens of services. This is especially true for gaming accounts used by you or your children, where usernames and passwords reused from healthcare portals become entry points for doxxing, swatting, or further extortion. Once the chain starts, it is difficult to stop without deliberate, ongoing effort.

Medusa Group's Publicly Known Track Record

Public reporting attributes Medusa with emerging in 2021 as a ransomware operation that combines double-extortion tactics with data leak sites. The group has targeted hospitals, schools, and other healthcare organizations in prior attacks. Its typical playbook involves initial access through compromised credentials or vulnerabilities, followed by exfiltration of sensitive files, encryption of systems where possible, and then public shaming on its leak site with countdown deadlines to pressure victims into payment. Medusa routinely posts samples of stolen data to prove possession and escalates by threatening to sell or publish the full archive.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to the Southwest CARE Center breach.
• Rotate any password you ever used at Southwest CARE Center or any healthcare provider, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed within hours rather than months.
• Cover your entire household with DoxxScan family protection, which extends to dependents and children's gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or spend weeks chasing removal notices.

The Southwest CARE Center breach is a clear reminder that healthcare data leaks continue to expose ordinary families to long-term identity and privacy risks. Taking concrete steps now can limit the damage before criminals connect the dots. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children's gaming accounts vulnerable to credential-stuffing attacks that follow incidents like this one.