Crenshaw Community Hospital 2025 Data Breach
Healthcare provider · Hospital and patient care services · Local medical facility · USA
Crenshaw Community Hospital Breach (2025): 72K Patient SSN & Home Address Records Exposed
Community hospital.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
67/100
Lower riskHigher risk
High and current: recent, valuable data circulating on the dark web now.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
72KRecords
2025Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
AddressPhysical address
Breach Summary
Crenshaw Community Hospital, a community hospital in Luverne, Alabama, experienced a ransomware attack discovered on June 16, 2025 when a network disruption impacted certain computer systems. The hospital engaged outside cybersecurity specialists, who confirmed that files were copied from CCH systems without authorization. The Payouts King ransomware group, a double-extortion operation that steals data and threatens publication if ransom demands are not met, claimed responsibility by listing CCH on its dark-web leak site and asserting it had exfiltrated 53 GB of data. After ransom demands went unmet, the group reportedly published the entire dataset. The breach affected approximately 72,000 individuals based on records indexed by breach-tracking services. Compromised fields included Social Security numbers, email addresses, phone numbers, and home addresses. As a community hospital, the underlying records exfiltrated by the attackers also include patient identity, insurance, billing, clinical, and treatment information typical of an integrated hospital operation, beyond the more limited field set surfaced publicly. Crenshaw separately warned patients in late July 2025 about a social-media scam impersonating a law firm and attempting to harvest personal information by referencing the breach. For affected patients, the practical risk profile combines severe identity-fraud exposure with rural-hospital-specific risks. The combination of name, address, and Social Security number is a strong base for synthetic identity fraud and fraudulent credit applications. Inclusion in the dataset confirms a hospital-care relationship in a small rural community where individuals may be readily identifiable based on name and address alone. Affected patients should freeze credit at all three U.S. bureaus, monitor health-insurance statements, and be especially cautious of solicitations from law firms or 'data breach assistance' services contacting them by social media or phone, which have been used in scams targeting Crenshaw patients. Verified communications from Crenshaw Community Hospital and authentic class-action notices come through formal mail, not Facebook posts or unsolicited messages.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
72K records analyzed
About Crenshaw Community Hospital
Crenshaw Community Hospital (CCH) is a small community hospital based in Luverne, Alabama, serving Crenshaw County and surrounding rural communities in south-central Alabama. Founded in 1963, the hospital provides emergency care, medical and surgical services, outpatient services, behavioral health, radiology, and home health services to a primarily rural population. As a small community hospital, CCH operates with a limited staff and serves as one of the few local healthcare options in its service area. As a HIPAA-regulated hospital, CCH maintains patient identity, contact, insurance, billing, and clinical records across its emergency, inpatient, outpatient, and home-health operations, alongside diagnosis, treatment, and prescription information typical of a community hospital.
Why They Hold Your Data
Local medical facilities collect patient identity, insurance, billing, and treatment data as part of hospital and community care operations.
Recent Developments
Crenshaw Community Hospital experienced a network disruption on June 16, 2025 that impacted the functionality of certain computer systems. The hospital engaged third-party cybersecurity specialists to investigate and secure its environment. The Payouts King ransomware group, which engages in double-extortion tactics, publicly claimed responsibility on its dark-web leak site, asserting it had exfiltrated 53 GB of data and subsequently published the entire dataset after ransom demands went unmet. Crenshaw issued a public notice on its website acknowledging the incident. The hospital also warned patients in late July 2025 about a social-media scam impersonating a law firm and attempting to harvest personal information from breach victims. The file review remained ongoing into the fall of 2025, and class-action investigations by U.S. plaintiff law firms began organizing in October 2025.
Data Points Exposed
4 verified field types
Email Address
Phone Number
Physical address High
Social Security Number Critical
Breach Impact
The institutional impact on Crenshaw Community Hospital is significant relative to its size as a small community hospital. Federal HIPAA notification obligations, an Office for Civil Rights review, Alabama attorney-general filings, and emerging class-action litigation discussions are all underway. Payouts King's publication of the full 53 GB dataset on its leak site creates direct evidence of broad data exposure and strengthens future litigation. Operationally, the hospital reported a network disruption that affected functionality of certain computer systems but maintained patient care. The reputational impact is concentrated within Crenshaw County and the surrounding rural region, where Crenshaw Community Hospital is one of the few local healthcare options and patient retention is unusually consequential. The follow-on social-media scam impersonating a law firm added secondary fraud-management work for the hospital.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A healthcare-linked breach: exposure ties a named individual to a provider relationship and, where clinical or insurance data is present, to conditions and treatment. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
PK
Threat Actor: Payouts KingConfidence: Low
Motivation: Financial
A low-confidence name that appears more like fraud-market branding than a conventional intrusion set. There is not enough reliable public sourcing for a standalone threat actor bio.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation