McAlester Regional Health Center
bd_72ed3abe8b59b82d · schema v1 · pii pii-v1
Full breach record for McAlester Regional Health Center →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Karakurt on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Founded in 1978, McAlester Regional Health Center is devoted to a continuum of care offering a variety of health care services to the citizens of Southeast Oklahoma. Another one medical center doesn't care about their patients' data. 126gb of this organization data includes medical information, personal documents, financial and accounting data and lots of HR documentation. 40gb of DNA tests of patients is a bonus! Stay tuned.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jul 28, 2023
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- HHS OCRbd_6e23414cd27637502023-08-21 · +24dCandidate
- Maine State AGbd_00762f4dda0869482023-11-15 · +110dVerified by operator
- Vermont State AGbd_6751323e8c15cad42023-11-15 · +110dVerified by operator
- Montana State AGbd_bd461962ac34b82e2023-11-15 · +110dVerified by operator
Show 2 more filings ↓Show fewer ↑up to 116d gap
- Massachusetts State AGbd_f831e61cf6da1edf2023-11-15 · +110dVerified by operator
- New Hampshire State AGbd_53dcc179f39114342023-11-21 · +116dVerified by operator
Filing propagation · 6 filings · 6 states
View merged incident ↗Pattern: first filing Aug 21 (OK), last Nov 21 (NH) — a 92-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
karakurt
According to ransomware.live, Karakurt is a pure data-extortion group (no encryption) assessed with high confidence to be the extortion arm of the Conti ransomware group, active from 2021, that steals data and threatens to auction or publish it unless ransoms ranging from $25,000 to $13 million are paid.