Hematology Oncology Consultants, a Michigan-based private practice specialising in hematology and oncology care, was named on October 17, 2025 as a victim of the Rhysida ransomware operation. The threat actor listed the practice on its dark-web leak site, although the listing as observed contained limited public detail beyond the attribution itself. The breach was subsequently surfaced and reported by dark-web monitoring services in mid-December 2025.\n\nThe breach affected approximately 63,000 individuals. Compromised fields included email addresses, phone numbers, home addresses, and Social Security numbers. As a hematology and oncology specialty practice, the underlying records exfiltrated by the attackers also include cancer and blood-disorder diagnostic, treatment, billing, and insurance information typical of an oncology specialty clinic. Public disclosure has emphasised the identity-data subset, while the broader medical-record exposure aligns with patterns observed in comparable oncology breaches.\n\nFor affected patients, the practical risk profile combines severe identity-fraud exposure with cancer-treatment-specific risks. The combination of name, address, and Social Security number is a strong base for synthetic identity fraud and fraudulent credit applications. Inclusion in the dataset confirms the existence of an oncology or hematology care relationship, which can support medical-themed scams referencing real treatments, infusion appointments, or insurance claims. Cancer patients are unusually attractive targets for emotionally manipulative phishing because their care relationships are often emotionally charged and high-frequency. Affected individuals should freeze credit at all three U.S. bureaus, monitor health-insurance explanation-of-benefits statements for unfamiliar charges, and treat any unsolicited contact referencing the practice, oncology treatment, or insurance verification with extreme caution.

Oncology practices collect highly sensitive patient identity, insurance, billing, appointment, and cancer-treatment records across specialty care operations.

Hematology Oncology Consultants was named on October 17, 2025 as a victim of the Rhysida ransomware operation, which listed the practice on its dark-web leak site. The breach was independently reported by dark-web monitoring services and breach-tracking aggregators. U.S. plaintiff law firms began organizing class-action investigations following the December 15, 2025 surfacing of the data on dark-web monitoring sites. The practice has not publicly released a detailed statement characterising the incident as of this writing. The Rhysida group has been active in healthcare-sector ransomware throughout 2025 and 2026, with multiple specialty-clinic and hospital victims.