Ransomware Group Anubis Claims Attack on Santiam Hospital & Clinics

Key points

• The Anubis ransomware group listed Santiam Hospital & Clinics, an Oregon healthcare provider, on its dark-web leak site on 28 October 2026.
• The group's post describes the incident as "a major medical data breach", wording written by the attackers to pressure the hospital into paying.
• Santiam Hospital & Clinics has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
• Healthcare is the sector Anubis targets most often, making this listing consistent with the group's documented pattern.
• Five fresh Anubis claims appeared in the past 30 days, suggesting the group is still actively operating.

Santiam Hospital & Clinics, a community healthcare provider in Oregon, was listed on the dark-web site run by the ransomware group Anubis on 28 October 2026. Ransomware is malicious software that locks a company's files until a ransom is paid. Groups like Anubis also run leak sites, hidden pages on the dark web where they publicly name organisations they claim to have attacked, using the threat of publishing stolen data as a second form of pressure.

Ransomware.live, a monitoring service that watches these sites so researchers and journalists do not have to visit them directly, first observed the listing on 28 October 2026. The attackers describe the incident only as "a major medical data breach." That phrasing is theirs, written to maximise pressure on the hospital, and deserves matching scepticism. Listings can be exaggerated and are occasionally false. No public statement from Santiam exists, and the claim carries no independent verification.

Why does a hospital claim from this group matter?

Anubis isn't a minor operation. We covered the group's claim against US funeral firm Newcomer Cremations on 25 October 2026, just three days before this listing appeared. Healthcare is the sector Anubis targets most frequently, and five more organisations were listed in the past 30 days alone. Those are criminal claims, not confirmed breaches, but the volume signals a group that is active and choosing its targets deliberately.

Hospitals are attractive to ransomware groups for a simple reason: the pressure to restore access to patient records is immediate and clinical. Encrypt the data, threaten to publish it, count on urgency to accelerate payment. It's a formula that works, which is why it keeps appearing in every postmortem.

Should you worry?

Because the claim is unverified, there's no reason to panic. Watch for phishing emails, fake messages designed to trick you into handing over passwords or clicking a harmful link. Criminals routinely send these after a hospital is named publicly, pretending to offer breach notifications or compensation claims. If you receive an unexpected email claiming to be from Santiam about a breach, do not click any links; go directly to the hospital's official website.

If you reuse the same password for a patient portal elsewhere, change it now. Password reuse is one of the most reliable ways a secondary account gets taken over after a breach scare. Be equally wary of unexpected calls offering breach-related compensation.

If this turns out to be real, the postmortem will note that weeks passed before patients knew to do any of this. Don't hand attackers that window.