A ransomware group known as Stormous claims to possess the stolen personal data and protected health information (PHI) of 600,000 North Country HealthCare patients. North Country HealthCare is a federally certified community health center that provides comprehensive healthcare services at 14 locations in northern Arizona.
Since early 2022, this pro-Russia ransomware group has been active in double extortion, data theft, and file encryption. Stormous demands ransom payment from the victim in exchange for the decryption keys and to avoid the exposure of the stolen information on its dark web data leak page. The group has attacked at least 150 companies, usually executing fewer than 10 attacks monthly. However, in May 2025, the group performed over 15 attacks. The group typically targets organizations in industries such as hospitality and tourism, business services, technology, government, and healthcare. The top five target nations of the group are the United States, Spain, France, the United Arab Emirates, and Brazil.
On July 13, 2025, the group’s data leak site listed North Country HealthCare. As per Stormous, it possesses the health data of 600,000 patients, which includes Protected Health Information (PHI), personally identifiable information (PII), clinic information, diagnostic codes (ICD), and provider information. The following information are included in the stolen data: complete name, birth date, gender, contact number, clinic name, visit date/place, health insurance company, ICD code, and an explanation of the diagnosis. The group says that the information of 100,000 patients will be posted for sale, while the information of 500,000 patients will be posted on the leak site accessible to the public.
The group released a statement on July 15, 2025, saying that it had already published the files. North Country HealthCare has not released any statement yet to confirm the dark web listing or the cyberattack or the data breach. However, as an entity with HIPAA certification, it is expected that North Country HealthCare will release a statement on the issue.
