The Dark Project ransomware group says it stole more than 400GB of patient and employee data from Bear Valley Community Hospital, a rural healthcare provider in California. The group listed the hospital on its leak site on November 10, 2026. The 400GB figure and the list of stolen data come only from the group's own posting, as repeated by QPulse and DataBreachRights. The hospital has not publicly confirmed an attack. No regulator filing or patient notification has been published, and no count of affected people has been disclosed.
What Happened
Several ransomware trackers recorded the claim on November 10, 2026. QPulse cites Ransomware.live as logging the listing at 19:51 UTC that day. Undercode News, citing the ThreatMon Threat Intelligence Team, reports the same date and lists the hospital alongside a separate claim by the BYOD group against Providence. Breach House has indexed the listing and captured 19 items from the leak site, including what it describes as proof files: 18 images, some of them letters and documents. Breach House lists the public disclosure status as "not disclosed yet."
What is still unknown:
- No confirmation. The hospital has made no public statement. DataBreachRights notes that no forensic findings, law enforcement involvement, or official breach notification have been made public.
- No timeline. When the attackers got in, and how long they were inside, has not been disclosed.
- No operational picture. No report says whether systems were encrypted or whether patient care was disrupted.
Undercode News stresses that no independent source has confirmed a successful intrusion. Until the hospital or a regulator says otherwise, this should be treated as a credible but unverified extortion claim.
What Was Taken
According to the group's posting, as relayed by QPulse and DataBreachRights, the stolen data includes:
- Employee data
- Confidential financial information and bank documents
- Patients' personal documents
- Social Security numbers
- Medical records, medical histories, and surgical records
The volume is stated as "over 400GB" in every report that gives a figure. All of those reports trace back to the attackers' own claim. No source gives a count of affected individuals. Breach House lists the organisation as having more than 1,000 employees, but that figure comes from its automated victim profile and has not been verified.
QPulse also cites an exposure report from ParanoidLab that found 124 leaked passwords linked to the hospital's domain, none rated critical, and no stolen session cookies. These may be old credential leaks that have nothing to do with this intrusion. QPulse also notes that the hospital uses Microsoft 365.
Why It Matters
If the claim holds up, this is a serious breach. Social Security numbers combined with medical and surgical histories are enough for medical identity fraud, which is hard to spot and slow to fix. Patients and staff are affected alike.
Small hospitals rarely have dedicated security teams, but they hold the same sensitive data as large health systems. They also face the same legal consequences. Recent cases show the pattern:
- Bigfork Valley Hospital, Minnesota. A small hospital hit in November 2024. Its class action settlement now offers up to $2,000 for documented fraud losses plus three years of medical identity monitoring, according to OpenClassActions.
- Valley Oaks Health, Indiana. A June 2023 breach affected 50,352 people. The HIPAA Journal reports that the resulting class action reached preliminary settlement only after the court rejected the provider's motion to dismiss.
In both cases the lawsuits followed the breach notifications. Bear Valley Community Hospital is likely to face the same pressure once notification letters go out.
Dark Project is also part of a steady stream of ransomware groups targeting US healthcare. On the same day, ThreatMon's feed showed a second healthcare claim from the BYOD group.
The Attack Technique
The way in is unknown. The hospital has not disclosed it, and none of the trackers or outlets covering the claim say how the attackers got inside. The available evidence points to the usual double-extortion model: steal data first, then threaten to publish it. Whether files were also encrypted is unconfirmed.
The ParanoidLab result is worth noting. Leaked passwords for a hospital that runs Microsoft 365 are a common starting point for ransomware intrusions, through password spraying or credential reuse. That is a lead to check, not a confirmed cause.
What Organizations Should Do
- Check for leaked credentials. Monitor for your organisation's domain in breach and infostealer data. Force password resets for any exposed accounts, and enforce phishing-resistant MFA on Microsoft 365, VPN, and remote access.
- Watch for large outbound transfers. 400GB leaving a small hospital network should trigger an alert. Set baselines for traffic leaving the network, and flag bulk transfers to cloud storage or tools like rclone and MEGA.
- Separate sensitive data stores. Keep HR, finance, and clinical document shares apart, and limit who can read them in bulk. Social Security numbers should not sit in general file shares.
- Plan for clinical operations without IT. Test offline backups and paper-based fallback procedures for admissions, pharmacy, and surgery scheduling.
- Prepare notification and identity protection in advance. Know your HIPAA and California notification deadlines, and arrange credit and medical identity monitoring vendors before you need them.
- Patients and staff of Bear Valley Community Hospital should freeze their credit, check insurance explanation-of-benefits statements for treatment they did not receive, and be wary of calls or emails that mention their medical details.
Sources: Dark Project Ransomware Group Exfiltrates 400GB of Sensitive Patien... | Valley Oaks Health Data Breach Settlement Gets First Nod from Court | Bear Valley Hospital Data Breach Claim: What to Know | Bear Valley Community Hospital — DARK PROJECT Ransomware Attack Br... | DarkProject Claims Bear Valley Community Hospital in Latest US Heal... | Healthcare Under Double Ransomware Pressure: BYOD Claims Providence... | Bigfork Valley Hospital Data Breach Settlement: Up to $2,000 | Bear Valley Community Services District - 813 updates