The Osiris ransomware group added Methodist Hospitals in Northwest Indiana to its dark web leak site on 11 November 2026. It gives an estimated attack date of 6 November. So far this rests only on what the attackers say. Methodist Hospitals has not publicly confirmed any incident, no regulator filing has been published, and no one outside the group has shown that data was stolen. Public trackers also disagree on whether the group has stated how much data it took.
What Happened
Methodist Hospitals is a nonprofit healthcare provider with facilities in Gary, Merrillville and the wider Northwest Indiana area. Ransomware.live, which tracks leak sites, first recorded the Osiris listing at 08:17 UTC on 11 November. The tracker gives the estimated attack date as 6 November, about five days before the listing went up. DeXpose reported the same claim on the same day and described it as a threat to leak sensitive data unless the group's demands are met.
The leak-site entry itself says very little. As reproduced by Ransomware.live and DeXpose, it reads "Status: Published | Country: United States | Revenue: $332,700,000 | Employees: 1001-5000". A "Published" status suggests Osiris says it has already released the data, which would usually mean any ransom talks have broken down or never started. Undercode News reports that Methodist Hospitals was posted in a batch of victims based mainly in the United States, the United Kingdom and Germany, and that it was the largest organisation in that batch.
Readers should not confuse this with a different organisation that has a similar name. Methodist Homes of Alabama and Northwest Florida, a senior living provider, is settling a class action over separate data incidents in October 2024 and May 2025, according to OpenClassActions and Dapeer Law. That case has nothing to do with the Osiris claim against the Indiana hospital system.
What Was Taken
Nobody knows yet, and the trackers disagree on the volume. Ransomware.live's entry lists 579.22GB of exfiltrated data. Undercode News says the opposite: according to its report, the listing gives no data volume, no file count and no downloadable sample, and it offers no technical evidence of access. DeXpose gives no figure. It is not clear whether the 579.22GB figure came from the group's post or was estimated by the tracker. Until someone independently checks it, treat it as unverified.
No one has described what kind of data is involved. For a hospital system, the obvious worry is patient records, insurance and billing details, and employee personnel files. Undercode News points out that nothing published so far shows patient records were taken.
Why It Matters
Ransomware is still the main driver of data breaches. The Washington State Attorney General's annual Data Breach Report, released on 9 November 2026, found that cyberattacks caused 139 of the 197 breaches reported to the state over the past year, with ransomware the most common method. Hospitals are a frequent target because their data is sensitive and because disruption puts pressure on them to pay.
Leak-site claims also cause harm on their own, whether or not they turn out to be true. Patients and staff may be phished by scammers who mention the claim. A "Published" listing can also mean the data is already being passed around, even if the hospital has not yet worked out its scope. Healthcare defenders in the region, and anyone who shares systems, vendors or network links with Methodist Hospitals, should check their own exposure now and not wait for the hospital to confirm.
The Attack Technique
Nobody has said how Osiris got in, if it did, and neither the hospital nor any investigator has commented. General research on healthcare breaches points to the usual routes. Phish Brief's breakdown of healthcare attacks describes a common sequence: stolen or reused credentials, often obtained by phishing, then movement across flat internal networks, then staging data on internal servers, then sending it out. Assurant's account of an unrelated breach at Mo Doc Offender, a health records provider, shows another common way in: a neglected third-party vendor web application. Neither case says anything about what happened at Methodist Hospitals. They only show which routes defenders should check first.
What Organizations Should Do
- Search for exposed credentials: Check infostealer logs and breach dumps for staff and vendor accounts on your domains. Reset any credentials found and enforce phishing-resistant MFA on remote access, email and clinical portals.
- Separate patient data from general IT: Put EHR databases, imaging stores and billing systems in their own network segments, so that one compromised workstation cannot reach them.
- Watch for large outbound transfers: Set alerts for unusual data staging and large uploads, especially to cloud storage or file-sharing services. Exfiltration on the scale Ransomware.live lists would generate noticeable network traffic.
- Review vendor and forgotten systems: List all internet-facing applications, including third-party portals and old backup or scheduling tools. Patch them or take them offline.
- Test backups and recovery: Keep offline, immutable backups. Rehearse restoring clinical systems so that an outage does not leave you dependent on the attackers.
- Prepare for follow-on fraud: If you work with Methodist Hospitals as a partner or vendor, warn staff about phishing that refers to the claimed breach. Check any payment or account change requests through a second, independent channel.
Sources: Ransomware.live - Victim: Methodist Hospitals in Northwest Indiana | Osiris Targets Methodist Hospitals in Northwest Indiana - DeXpose | Osiris Ransomware Group Claims Methodist Hospitals in Northwest Ind... | Methodist Homes Data Breach Settlement: $52.50 or Up to $5,000 | Methodist Homes of Alabama Data Breach Settlement | AG’s annual Data Breach Report recommends stronger protections for... | How Healthcare Data Breaches Work: Step-by-Step Attack Paths | Mo Doc Offender: Dissecting the Anatomy of a Healthcare Data Breach...