Sunflower Medical Group
bd_95b97ef45c6a1807 · schema v1 · pii pii-v1
Full breach record for Sunflower Medical Group →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Rhysida on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Sunflower Medical Group With only 7 days to spare, take the opportunity to bet on exclusive, unique, and impressive data. More than 400 thousand driver's licenses, insurance cards, social security numbers. Sql base is more than 3TB. Open your wallets and get ready to buy exclusive data. We sell only to one person, no resale, you will be the only owner!
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Dec 15, 2024
Claim posted
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (10) · sorted by filing gap
- Illinois State AGbd_dcfd70734cbc00352025-03-01 · +76dCandidate
- Vermont State AGbd_0287312e9299b7db2025-03-07 · +82dVerified
- Nebraska State AGbd_11c58a3f9c5c03982025-03-07 · +82dVerified
- HHS OCRbd_3d351c7dbcb8fcb42025-03-07 · +82dVerified by operator
Show 6 more filings ↓Show fewer ↑up to 148d gap
- Maine State AGbd_b09dbb58ef0fad222025-03-07 · +82dVerified
- Massachusetts State AGbd_c63e9d10412ec1162025-03-07 · +82dVerified
- Montana State AGbd_df8e68de2fa412282025-03-07 · +82dVerified
- California State AGbd_f42c06780ea08d462025-03-07 · +82dVerified
- New Hampshire State AGbd_a789960305d766a82025-03-10 · +85dVerified
- Vermont State AGbd_6382a8ad836487d72025-05-12 · +148dVerified
Showing first 10 of 11 linked disclosures.
Filing propagation · 11 filings · 9 states
View merged incident ↗Pattern: first filing Dec 15, last May 12 (VT) — a 148-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
rhysida
According to ransomware.live, Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files. Source: https://github.com/crocodyli/ThreatActors-TTPs