TuftsMedicine Listed by Cloak Ransomware Group

On September 7, 2025, healthcare provider Tufts Medicine appeared on the leak site of the cloak ransomware group, confirming that internal files had been exfiltrated during a ransomware attack.

What Public Reporting Shows

Public reporting indicates the organization was listed on the cloak leak portal that same day. Available details show that attackers gained access to internal systems, exfiltrated files, and later published a sample of the stolen data as proof. The exact number of people affected remains unknown, but any patient, employee, or vendor whose records were stored in the compromised systems could have information exposed. Internal files were taken; specific categories mentioned in initial posts include documents that typically contain names, addresses, dates of birth, medical records, insurance details, and employment information.

The incident follows the group’s standard pattern of encrypting systems, exfiltrating data before triggering the ransomware, and then pressuring victims with public exposure. No evidence has surfaced that the stolen data has been sold on additional underground markets yet, but such secondary distribution is common once initial negotiations fail.

Why This Matters for You and Your Family

When a healthcare organization’s internal files are stolen, the information taken is among the most sensitive you can have. Medical histories, Social Security numbers, insurance policy numbers, and home addresses do not expire. Once exposed, they can be used for years to file fraudulent tax returns, open accounts in your name, or impersonate you during medical visits. For families this risk multiplies: one parent’s records often link to a spouse and children, creating a single point of failure that can affect everyone at home.