Two separate ransomware groups have claimed responsibility for a cyber attack on Interim HealthCare, stating that they stole several gigabytes of sensitive patient data.
On August 10, the Genesis ransomware group claimed that it had gained unauthorised access to the internal network of Interim HealthCare of Oklahoma and Tulsa. The group alleged that it had exfiltrated roughly 1 TB of sensitive patient information from the organisation.
Interim HealthCare is a nationwide network of franchise locations providing a range of healthcare services, including in-home medical care, senior assistance, hospice care, and temporary healthcare staffing. The organisation is headquartered in Sunrise, Florida, and has operations across 40 U.S. states.
According to the ransomware group, the compromised information included medical records, healthcare-related data, personal information, patient lists, clinical records, and other company data. The group reportedly threatened to make the entire stolen database publicly available if its ransom demands were not fulfilled.
Healthcare leaders: Genesis and Anubis allege Interim HealthCare data theft; 1TB + 530GB, including patient data. HHS OCR notified July 31. Verify backups. Test your response plan. Ransomware targets healthcare. pic.twitter.com/kNF1JNfkm6
— Techsico IT (@Techsico_IT) September 11, 2026
Later that month, the infamous Anubis ransomware group also claimed to breach the internal network of Interim HealthCare and listed it as a victim on its data leak site.
According to The HIPAA Journal, the group claimed to have exfiltrated approximately 530 GB of data and released samples of the stolen information as evidence to support its claims. The compromised information included franchisees’ financial details, records of internal and external audits, communications concerning operational challenges, and various memoranda related to routine business activities.
The group has since released the stolen data publicly, suggesting that ransom negotiations with the organisation were unsuccessful.
As of the latest available reports, Interim HealthCare has not publicly confirmed or acknowledged the claims of the ransomware groups. However, in a filing with the U.S. Department of Health and Human Services, Interim HealthCare of Oklahoma City reported a “network server hacking incident” that affected 500 people.
