Coalinga Regional Medical Center, a critical-access hospital in Coalinga, California, was identified in early July 2025 as a victim of a ransomware attack claimed by the World Leaks ransomware group. The threat actor listed the hospital on its dark-web leak site, indicating data theft from CRMC's systems. The hospital has not extensively detailed the incident in public statements as of this writing.\n\nThe breach affected approximately 13,000 individuals based on records indexed by breach-tracking services. Compromised fields included email addresses, phone numbers, home addresses, and Social Security numbers. As a hospital, the underlying records exfiltrated by the attackers also include patient identity, insurance, billing, and clinical information typical of an emergency, inpatient, and outpatient operation, beyond the more limited field set surfaced publicly.\n\nFor affected patients, the practical risk profile combines identity-fraud exposure with rural-hospital-specific risks. The combination of name, address, and Social Security number is a strong base for synthetic identity fraud and fraudulent credit applications. Inclusion in the dataset confirms a hospital-care relationship in a small rural community where individuals may be readily identifiable based on name and address alone. Patients in rural areas often have fewer financial-fraud detection resources and may face greater difficulty unwinding identity-theft consequences. Affected individuals should freeze credit at all three U.S. bureaus, monitor health-insurance statements, and treat unsolicited contact referencing Coalinga RMC or past hospital visits with caution.

Regional hospitals collect patient identity, contact, insurance, billing, and medical records across emergency, inpatient, outpatient, and administrative systems.

Coalinga Regional Medical Center was identified as a victim of the World Leaks ransomware group in early July 2025, with the threat actor claiming responsibility and listing the hospital on its dark-web leak site. The hospital has continued to operate following the incident, although detailed public disclosure has been limited as of this writing. U.S. plaintiff law firms began organizing class-action investigations following the breach claim. The World Leaks group has been active throughout 2025 with multiple healthcare and senior-care victims, including Family Farm and Home and Heritage Communities earlier in the year. As a critical-access hospital, Coalinga RMC operates under federal Medicare reimbursement rules that include cybersecurity-readiness expectations.