GENESIS and Anubis Ransomware Gangs Target Interim HealthCare

Executive Summary

Interim HealthCare, a leading U.S. provider of home care and healthcare staffing services, is the apparent victim of a complex cyberattack involving two distinct ransomware gangs. In August 2026, both the GENESIS and Anubis ransomware groups posted claims on their respective dark web leak sites, asserting they had independently breached the company's network. The groups claim to have exfiltrated a combined total of over 1.5 terabytes of sensitive data, including patient medical records and corporate financial information. This double-claim scenario complicates the incident response and highlights the severe data security risks facing the healthcare sector.

Threat Overview

The competing extortion claims appeared just days apart, suggesting either a sequential compromise or two independent intrusions.

• GENESIS Claim (August 10, 2026): The GENESIS group was the first to list Interim HealthCare, claiming to have stolen approximately 1 terabyte of data. Their post suggested the attack targeted the provider's locations in Oklahoma City and Tulsa, with the stolen data including patient medical records and clinical information.

• Anubis Claim (August 21, 2026): Eleven days later, the Anubis ransomware group made its own claim. Anubis alleged it had exfiltrated 530 gigabytes of corporate data, such as franchisee financial details, internal audits, and business communications. The group has reportedly published samples of the stolen data, indicating a ransom was likely not paid.

Interim HealthCare has not officially confirmed the breaches. However, a related entity in Oklahoma reported a hacking incident to the U.S. Department of Health and Human Services (HHS) on July 31, 2026, which may be connected.

Technical Analysis

Both groups employ a double extortion strategy, which involves:

1. T1048 - Exfiltration Over Alternative Protocol: Stealing sensitive data from the victim's network before encryption.
2. T1486 - Data Encrypted for Impact: Encrypting files on the victim's systems to cause operational disruption.
3. Extortion: Threatening to publish the stolen data on a public leak site if the ransom is not paid.

The Anubis Ransomware is noted to be particularly destructive, as it reportedly includes an optional "wipe mode" that can permanently destroy files, even if a ransom is paid or backups are available.

Impact Assessment

The alleged breach poses a severe threat to Interim HealthCare and its patients.

• Patient Data Exposure: The theft of protected health information (PHI) could lead to identity theft, fraud, and a significant violation of patient privacy, with major implications under HIPAA.
• Operational Disruption: If systems were encrypted, it could severely impact the delivery of care to patients relying on home health and hospice services.
• Financial and Reputational Damage: The incident could result in substantial regulatory fines, legal costs from class-action lawsuits, and a loss of trust from patients and business partners.
• Complex Incident Response: Dealing with two separate threat actors with competing claims creates a highly complex negotiation and remediation scenario.

IOCs — Directly from Articles

No specific Indicators of Compromise were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for signs of Anubis or similar ransomware activity:

Detection & Response

1. EDR/XDR: Deploy endpoint detection and response tools configured to detect ransomware behaviors, such as rapid file encryption, shadow copy deletion (vssadmin), and the creation of ransom notes.
2. Data Loss Prevention (DLP): Use network and endpoint DLP solutions to monitor and alert on large-scale exfiltration of sensitive data, especially PHI.
3. Threat Hunting: Proactively hunt for signs of lateral movement using tools like RDP or PsExec, which are common precursors to ransomware deployment.

Key D3FEND techniques include D3-NTA: Network Traffic Analysis for exfiltration detection and D3-FR: File Restoration as a core response capability.

Mitigation

Standard ransomware defenses are critical for healthcare organizations:

1. Offline Backups: Maintain immutable, offline backups of critical data and systems and regularly test the restoration process.
2. Network Segmentation: Segment networks to prevent ransomware from spreading from IT systems to critical clinical systems or between different business units.
3. Multi-Factor Authentication (MFA): Enforce MFA on all remote access points (VPNs, RDP) and for all privileged accounts.
4. User Training: Conduct regular phishing awareness training for all employees, as it remains a primary initial access vector for ransomware.