2026 Healthcare Highways — Chaos ransomware leak-site dump; 235GB PHI/claims claimed (unverified census)
Data compromised
Actor-claimed 235 GB: company and client records including insurance-claim PHI (patient/employee names, SSNs, DOBs, addresses, diagnoses, claim/payment fields, provider NPIs). DataBreaches inspected samples and found matching types, including employee/dependent SSNs for named clients Leander ISD and John Soules Foods. No attested individual census — recordsAffected 0 labeled unverified.
Technical writeup
Unverified ransomware leak-site dump — Chaos (RaaS, tracked since March 2025) listed Healthcare Highways on 5 August 2026 with a 24-hour clock and a claimed 235 GB of company and client records. DataBreaches.net reported on 17 August that files were published after no contact; reporters inspected a portion and found claim-file field inventories (patient/employee SSNs, DOBs, addresses, diagnoses, payment amounts, provider NPIs), prescription/high-cost/high-risk patient lists, and spreadsheets for clients including Leander Independent School District and John Soules Foods (employee and dependent SSNs; Leander names matched a public school directory). Healthcare Highways did not reply to DataBreaches. Some files appeared encrypted by the victim with decrypted copies also present; no Chaos encryption extension observed on inspected files. Distinct from other 2026 Chaos rows (InfoSync, NeoPharm, CorePharma). recordsAffected 0 pending an attested person count. Labeled unverified as to company confirmation; dump contents described from DataBreaches inspection.
Root cause
Unverified Chaos RaaS leak-site listing (added 5 August 2026) followed by a public dump after a 24-hour countdown; Healthcare Highways had not confirmed at indexing