On 31 May 2023 Minnesota-based healthcare network CentraCare was drawn into the sweeping MOVEit supply-chain attack when the Cl0p ransomware gang exploited the zero-day vulnerability CVE-2023-34362 in a MOVEit Transfer server operated by its patient-engagement vendor Virgin Pulse (formerly Welltok). During the brief window before Progress Software disclosed the flaw attackers silently copied a file set labeled “CCH_CentraCare_Encounter.txt.” , For more than a year nothing surfaced publicly but on 4 December 2024 the 782 282-record database appeared on BreachForums and other leak markets advertised under the handle “centracare.com-2024.” Each row carried a full name and street address and most included phone numbers email addresses treating-doctor names diagnosis codes insurance-provider details and outstanding account balances. Although no Social Security or payment-card numbers were present security analysts warned that the combination of rich medical context and reliable contact triads would be prime fuel for prescription fraud medical-identity theft and highly tailored phishing campaigns. CentraCare did not acknowledge the exposure until journalists sought comment on the dark-web listing; the system’s short statement emphasized that its own network remained “secure” and placed responsibility on an unnamed third-party vendor yet it offered no specifics on the number of patients notified or whether credit-monitoring services would be extended. Privacy advocates criticised the opacity noting that patients generally learn of MOVEit-related leaks months after the fact and that a single year of monitoring-if offered at all-does little to protect individuals whose clinical data can retain black-market value indefinitely. The incident has so far escaped stand-alone litigation but plaintiffs’ lawyers involved in the consolidated In re MOVEit Customer Data Security Breach multidistrict proceeding say CentraCare could be added as discovery uncovers new chains of custody for the stolen files.