The extortion group Dark Project claimed on August 5, 2026 that it stole more than 550 GB of data from Mile Bluff Medical Center, a rural hospital in Mauston, Wisconsin, and published a dark web download link for the material. The group puts the number of affected patients and staff above 25,000. Every figure in this brief originates with the attacker, not the hospital: MedRisk reports that Mile Bluff has not commented publicly, and that the listing was logged as unverified by ransomware.live, DeXpose, and GalaxyWarden. No regulator filing, breach notification, or victim statement corroborating the claim appears in any source reviewed here. Treat the 550 GB and 25,000 figures as adversary marketing until the hospital or HHS OCR says otherwise.
What Happened
Dark Project added Mile Bluff Medical Center to its leak infrastructure on August 5 and, per MedRisk, moved past the threat stage to actually posting a download link, which is consistent with a failed negotiation or a victim that never engaged. MedRisk describes Dark Project as a group that has been rapidly adding victims over the same week, so this listing is one of a cluster rather than an isolated operation.
Mile Bluff has operated since 1912 and provides acute emergency care alongside long-term nursing and rehabilitation services. That profile matters: it is a small-town facility carrying a full clinical data estate on what is very likely a lean IT team, which is precisely the target shape these crews favor.
The only other source here that touches Mile Bluff directly is ClassAction.org, which on August 6 opened a plaintiff-solicitation page describing the incident as exposing Social Security numbers and inviting affected individuals to contact attorneys about a potential class action. That is a legal-marketing page, not independent verification. Its practical significance is timing: litigation intake began within a day of the leak post, well before any confirmed notification.
What Was Taken
According to Dark Project's own listing, relayed by MedRisk, the dump includes:
- A full SQL database backup
- Employee records and bank records
- Patient files containing Social Security numbers, medical histories, and surgical records
Volume is stated as more than 550 GB, with the affected population put above 25,000 patients and staff. There is no competing figure to weigh against these, because no second source independently counts the records. That absence is itself the finding. Where multiple sources exist for a breach, the counts usually diverge; here we have one attacker-supplied number, echoed once, and nothing else.
The claimed content mix is worth reading carefully. A full SQL backup plus staff banking data means the exposure runs in two directions at once: patient identity and medical fraud risk on one side, and direct payroll and account-takeover risk against hospital employees on the other. Surgical records and medical histories are effectively permanent identifiers. Credit monitoring does not undo them.
What Remains Unconfirmed, and What Belongs to Other Incidents
Several sources circulating alongside this story describe entirely separate events and should not be folded into the Mile Bluff count.
The Wisconsin Department of Health Services incident reported by FOX 11, WisBusiness, Almeida Law Group, and EmailMeNow is a different matter altogether. DHS notified 8,157 Medicaid Supplemental Security Income members on June 30, 2026 that benefit-increase letters had been mailed to outdated addresses. It was discovered April 30, filed with HHS OCR on July 1 as Unauthorized Access/Disclosure involving Paper/Films, and Almeida Law Group states plainly that it was a misdirected mailing, not a cyberattack or ransomware event. Same state, same sector, unrelated cause. Almeida also notes three prior Wisconsin Medicaid-population incidents: 2,868 individuals in a 2021 email account compromise, 12,358 in a 2022 emailed-presentation disclosure, and 19,150 tied to a 2024 incident at partner organization Disability Rights Wisconsin.
The Texas Hearing Institute breach covered by HIPAA Journal and HEAL Security is likewise separate, but it is the single most useful comparison available. A Houston pediatric hearing center detected unauthorized access on March 20, 2026, confirmed data exposure on April 22, and notified at least 29,498 Texas residents that names, Social Security numbers, financial information, and medical records were compromised. The Interlock ransomware group had listed the organization in early April claiming 540 GB stolen. That case shows the full arc the Mile Bluff claim has only started: leak-site listing first, forensic confirmation roughly a month later, notification and 24 months of credit monitoring after that, with the total individual count still unclear even at notification time.
Why It Matters
The Interlock and Dark Project claims are 540 GB and 550 GB respectively, against victim populations of roughly 29,500 and 25,000. Two unrelated crews, two small specialty healthcare providers, near-identical haul sizes. That is what a mature, repeatable playbook against under-resourced healthcare looks like, and the volume is a function of how these organizations store data rather than how hard the attackers worked. Half a terabyte is roughly what falls out when a single unsegmented file share and one database backup directory are accessible from a compromised account.
The Texas case also confirms that a leak-site claim can precede the victim's own confirmed data review by more than a month. Defenders and affected individuals therefore operate in a window where the attacker is the only source of information and has every incentive to inflate it, while the hospital is legally and forensically unable to say much. Silence from Mile Bluff is not evidence that the claim is false; it is the expected posture at this stage.
For rural and critical access facilities specifically, MedRisk's framing is correct and worth restating: these hospitals hold high-value clinical and financial data while running lean IT teams, which makes them the highest yield-per-effort targets in the sector.
The Attack Technique
No source establishes an initial access vector for Mile Bluff. No CVE, no phishing lure, no compromised remote access appliance has been named, and any specific claim to the contrary should be discounted.
What can be said is structural. MedRisk describes the standard pattern behind claims of this type as double extortion: encrypt systems, copy records, then threaten to leak the stolen data if payment does not arrive. Publication of the download link indicates that cycle reached its terminal stage. The claimed contents point at the same staging pattern seen repeatedly in these cases, where the attacker locates a database backup and bulk HR and finance shares rather than exfiltrating record by record. The Texas Hearing Institute incident, per HIPAA Journal, produced a comparable haul and is assessed by that outlet as a ransomware event, though the notification letters themselves did not describe the attack.
What Organizations Should Do
- Treat an unverified leak-site claim as real until forensics prove otherwise. MedRisk's guidance to rural facilities is to assume the claim is accurate and begin incident response rather than waiting for confirmation, because the confirmation gap in comparable cases has run a month or longer.
- Audit who can reach SQL backups and patient record stores. Backup directories and bulk record shares are what these groups actually take. Restrict access to named service accounts, log every read, and alert on bulk access patterns.
- Separate staff data from clinical data. The Mile Bluff claim includes employee bank records alongside patient files, which suggests HR, finance, and clinical stores were reachable from the same foothold. Segment them.
- Verify offline, immutable backups by restoring from them, not by checking that the job succeeded. Untested backups are the reason encryption converts into payment.
- Prepare the notification pipeline before you need it. The Texas Hearing Institute took from March 20 detection to April 22 confirmation to notification with 24 months of credit monitoring. Knowing in advance who counts affected individuals, who files with the state AG and HHS OCR, and who fields calls compresses that timeline substantially.
- Use the free resources. MedRisk points rural providers to CISA services and state-based security assistance programs, which cover vulnerability scanning and incident response support at no cost for facilities without dedicated security staff.
- Expect litigation intake to open immediately. ClassAction.org began soliciting Mile Bluff plaintiffs on August 6, one day after the leak post. Legal and communications should be engaged at the same hour as forensics, not after.
Sources: Dark Project claims Wisconsin hospital breach, dumps 550 GB of pati... | Almost 30,000 Texas Residents Affected by Data Breach at The ... | WED Healthcare Report: DHS notifies Medicaid members about possible... | Wisconsin Department of Health Services Data Breach Investigation... | 2 New HHS OCR Breach Submissions Dated July (2026) EmailMeNow | Almost 30,000 Texas Residents Affected by Data Breach at The Texas... | Mile Bluff Medical Center Data Breach Exposes SSNs; Lawsuit Possible | Wisconsin DHS notifies Medicaid recipients of potential personal in...