WindRose Health Network Data Breach

WindRose Health Network, a community healthcare provider in the United States, was listed by the Storm ransomware group on August 18, 2026. The threat intelligence was identified through SOCRadar Dark Web Monitoring, flagging the domain windrosehealth[.]net. The healthcare sector is a frequent target for ransomware operations due to the sensitive nature of patient data and the critical services provided, making organizations within this industry particularly susceptible to extortion. Storm ransomware has targeted 24 other organizations in the past 60 days, with a primary focus on the healthcare sector and a core geographic concentration in the United States. Recent U.S. healthcare victims attributed to Storm include the Canadian Mental Health Association, Rood & Riddle Equine Hospital, OVP Health, and Liberty Healthcare Corporation. WindRose Health Network’s inclusion directly aligns with this pattern of targeting within the healthcare industry.

A query against the domain windrosehealth[.]net for stealer-log data returned one corporate credential. This credential, nsu****g@windrosehealth[.]net, was logged on July 13, 2026, and was associated with login.microsoftonline.com. This indicates that credentials for a Microsoft 365 tenant were compromised 36 days prior to the Storm ransomware group listing WindRose Health Network. The potential scope of this compromise includes access to email, Microsoft Teams, SharePoint, OneDrive, and other downstream SaaS applications linked to the Microsoft 365 tenant. It is important to note that this represents a single record from a sample, and additional credentials may exist within the broader dataset or other corporate domains not covered by this specific query. The discovery of a Microsoft 365 credential predating the ransomware listing by over a month is a high-risk finding. This credential may have been leveraged for initial access or persistence within WindRose Health Network’s environment, potentially facilitating lateral movement and the deployment of ransomware. The compromised account provides access to sensitive corporate resources, and the possibility of further compromised accounts or other intrusion vectors cannot be ruled out based on this single data point. Immediate action is recommended, including forcing a credential reset for the identified account, revoking any active sessions or OAuth tokens associated with it, and conducting a thorough audit of Microsoft 365 sign-in logs from July 13, 2026, to the present date to identify any suspicious activity.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.