Rhysida, a ransomware group known for targeting healthcare organizations, breached MedStar Health's systems between September 12 and September 16, 2025, exfiltrating 3.7 terabytes of data. MedStar, a nonprofit health system serving patients across Maryland, Virginia, and Washington D.C., discovered the intrusion on October 4. Rhysida listed the stolen data for sale on its dark web site at 25 bitcoin and, when MedStar did not pay, published the files publicly. The breach is estimated to affect 4.6 million patients. The exposed data includes names, home addresses, phone numbers, email addresses, Social Security numbers, and medical diagnoses, along with potentially medications, test results, medical images, insurance information, and treatment records. The combination of Social Security numbers and medical diagnoses creates layered risk. Affected individuals face potential identity theft, fraudulent tax filings, medical identity fraud in which someone uses another person's insurance or benefits, and targeted scams that exploit knowledge of a person's health condition or care history. MedStar began notifying affected patients by mail on December 3, 2025, and is offering complimentary credit monitoring and identity theft protection. The organization engaged third-party cybersecurity experts and notified the FBI. A consolidated federal class-action lawsuit was filed in December 2025, alleging negligence and seeking financial damages and court-ordered security improvements. Individuals who received a breach notice should enroll in the offered monitoring services promptly and remain alert to unsolicited contact referencing their medical care, insurance, or personal finances.

Integrated health systems collect patient identity, contact, insurance, billing, appointment, and clinical records across hospitals, clinics, and administrative operations.

MedStar has been managing sequential cybersecurity incidents. A prior breach involving compromised employee email accounts led to a $1.35 million class-action settlement finalized in 2024. The 2025 Rhysida ransomware attack occurred against that backdrop. This is also not MedStar's first ransomware encounter — a March 2016 attack forced the system to shut down multiple systems for approximately a week. The pattern of repeated incidents has sustained regulatory and litigation attention on the organization's security posture.