Cookeville Regional Medical Center Breach

TL;DR: Our current parse of the Cookeville Regional Medical Center (CRMC) leak shows 13,300 unique Social Security numbers, alongside 20,500 street addresses, 8,500 phone numbers, and 7,700 email addresses. On Rhysida’s portal, the CRMC card lists a 538GB / 372,574-file data catalog and a 70% progress bar with the caption “Not sold data was uploaded, data hunters, enjoy.” Totals may increase as additional archives land.      
      

What happened-and when      

CRMC reported a network security incident in July 2025 that disrupted operations. Soon after, the Rhysida ransomware operation claimed responsibility, posted proof-of-theft samples, and advertised a 10-Bitcoin demand with an auction countdown-classic double-extortion.      
      

Release status (why counts may rise)      

The leak portal currently shows 538GB across 372,574 files and marks the dump 70% complete with a “not sold” caption-signaling a public release rather than a private sale. As remaining tranches arrive, de-duplication and entity linking typically nudge unique counts upward.    
      
Our parse so far      

• 13,300 unique SSNs      
• 20,500 unique street addresses      
• 8,500 unique phone numbers      
• 7,700 unique email addresses      
  Figures are preliminary and will be updated if later archives materially change the picture.      
        

What the data mix signals      

The combination of SSN + full address + phone is the high-risk pattern for:      

• Tax-refund fraud and synthetic identity creation      
• Credit-file takeover and long-tail medical identity theft      
• Targeted phishing and social-engineering attacks against both patients and staff      
  Healthcare leaks frequently include HR/finance records (e.g., W-2s, driver’s licenses) alongside patient data, expanding exposure beyond clinical files.      
        

What’s confirmed vs. unknown      

Confirmed      

• Ransomware attack with operational disruption      
• Rhysida’s public claim, proof samples, and 10-BTC auction language      
• Ongoing public posting of the dataset (70% indicator).   
    
  Unknown (as of publication)      
• Final person-count totals and the hospital’s definitive list of data types      
• Initial access vector (phishing, remote access, third-party, etc.)      
• Whether the entire 538GB will ultimately post      
        

Practical steps for affected individuals      

• Place a credit freeze with all three major bureaus; consider a fraud alert      
• Create/lock an IRS online account; watch transcripts for anomalies      
• Review insurer EOBs for unfamiliar services and dispute immediately      
• Rotate passwords for any patient/staff portals and enable MFA      
• Save any official notice for documentation and rights timelines