Insightin Health
bd_04a0838032966f07 · schema v1 · pii pii-v1
Full breach record for Insightin Health →2 incidents on fileThreat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Medusa on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Insightin Health helps healthcare payers eliminate data silos and deliver highly satisfying consumer-centric experiences. inGAGE our software as a service (Saas) platform is the industry leading solution for quickly creating a connected data ecosystem. Using artificial intelligence and machine learning techniques, inGAGE leverages the totality of the connected data, in real-time, to produce insights that drive Next Best Action (NBA) recommendations to solve pressing healthcare challenges. inGAGE allows healthcare payers to deliver lifetime member value, driving growth and increasing overall plan profitability. company is headquartered in 333 W Ostend St. Suite 100 Baltimore, MD 21230. 45 Employees. The total amount of data leakage is 378 GB
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Sep 23, 2025
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- HHS OCRbd_f9dc8500fdfbdf8c2026-01-16 · +115dVerified
- Vermont State AGbd_35cace97c849afa22026-01-28 · +127dVerified by operator
- Vermont State AGbd_30942dbf93d1eb242026-03-04 · +162dVerified by operator
- Montana State AGbd_d26a3eeabbd32ef72026-03-04 · +162dVerified
Show 6 more filings ↓Show fewer ↑up to 190d gap
- Washington State AGbd_17bef6ae03a1347e2026-03-05 · +163dVerified by operator
- Oregon State AGbd_3070c615628a95182026-03-05 · +163dVerified
- California State AGbd_3bdd8091c9b79d352026-03-05 · +163dVerified by operator
- Texas State AGbd_d1b693a2d4ddee3f2026-03-10 · +168dVerified
- California State AGbd_7fc85ada2e1884b92026-04-01 · +190dVerified by operator
- Vermont State AGbd_9a2bd835940a41492026-04-01 · +190dVerified by operator
Filing propagation · 10 filings · 7 states
View merged incident ↗Pattern: first filing Jan 16 (MD), last Apr 1 (VT) — a 75-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
medusa
According to ransomware.live, Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.