Tri-Cities Gastroenterology Listed by Insomnia Ransomware Group
If you are a customer of Tri-Cities Gastroenterology, here’s what is being claimed, and what it would mean for you.
Tri-Cities Gastroenterology provides comprehensive digestive care focused on whole-person wellness, using human and technological resources to ensure patient comfort and timely, reliable information and reports for referring physicians.
— from Insomnia’s own leak-site posting. This is the group’s claim, quoted verbatim; it is not GalaxyWarden’s reporting and has not been independently verified.
On December 16, 2025, medical practice Tri-Cities Gastroenterology appeared on the leak site of the insomnia ransomware group in a listing claiming internal files were exfiltrated during a ransomware attack.
Watch Tri-Cities Gastroenterology
Get alerted the next time Tri-Cities Gastroenterology files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Tri-Cities Gastroenterology’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the group posted details of the incident on its dark-web leak portal, accessible via the .onion address hosted on ransomware.live. The exposed material consists of internal files taken during the ransomware operation. The number of patients or individuals whose records were compromised remains unknown at this time. Tri-Cities Gastroenterology is a medical provider offering digestive care services in the Tri-Cities region. No evidence has surfaced that the stolen data has been distributed beyond the group’s leak site so far.
- Every indexed leak tied to your address — all of them, named and dated
- A deeper search of collected breach data — the kinds of your information it holds, where it finds you
- What this kind of incident typically exposes
- A ten-minute lock list written for this kind of organisation
Why This Matters for You and Your Family
When a healthcare provider’s systems are breached, the information at risk often includes names, dates of birth, Social Security numbers, addresses, phone numbers, insurance details, and clinical notes. Even if your own records are not confirmed in this specific posting, medical breaches create long-term privacy risks because health data is difficult to change and retains value to identity thieves for years. For you and your family, a single leak can lead to fraudulent insurance claims, unexpected medical bills in your name, or the sale of your contact details on underground markets. Children’s records, sometimes included in family insurance files, face similar dangers once exposed.
The Doxxing and Identity-Chain Implications
Stolen medical files frequently contain enough personal details to link disparate online accounts. A phone number or email from one breach can be combined with information from earlier leaks to map your full digital footprint. This process, known as identity chaining, allows attackers to locate social-media profiles, gaming usernames, and even family members’ accounts. Credential leaks like this one often cascade into account takeovers on unrelated services. Gaming accounts belonging to you or your children are especially vulnerable because they frequently reuse passwords or recovery emails tied to the same household address listed in medical records.
What to Do
- Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist today.
- Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught within hours rather than months.
- Rotate any password you used on portals or patient systems at Tri-Cities Gastroenterology and replace it with a unique passphrase everywhere it has been reused; enable two-factor authentication through an authenticator app on every account that offers it.
- Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that can be traced back to the same address or parent email.
- Let remediation specialists handle the repetitive work of sending takedown notices to data brokers and monitoring whether any of the exposed files surface for sale.
The incident underscores a simple reality: once medical or personal records leave a provider’s control, you cannot rely on the organization to protect you indefinitely. A forward-looking approach means assuming your information will appear in future leaks and maintaining constant visibility into how it travels online. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting proactive steps now limits what attackers can build from any single breach.
What the free scan actually returns
Found on people-search siteswe remove these
These listings are live, public, and legal to remove — and removing them is what we do.
Found in breach recordsverifiedreported — unverified
Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.
Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.
