Anubis group claims a ransomware attack on Singing River Health System

The Anubis ransomware group claimed responsibility for the cyber attack on Mississippi-based healthcare provider Singing River Health System that compromised the sensitive personal information of more than 50,000 individuals.

The ransomware group claimed responsibility for the cyber attack on June 4 and listed the healthcare provider as a victim on its data leak site. 

According to the group’s post, it has stolen approximately 293 GB of data from Singing River Health System’s network. The compromised data allegedly contains more than 1.2 million files. To support its claim, the group has also published sample images allegedly taken from SRHS.

Anubis’s claim arrived not long after the healthcare provider announced a major cyber security incident through an incident notice published on its website. 

SRHS said that it suffered unauthorised access to its internal network in late December. After detecting the incident, the healthcare provider quickly launched an investigation to determine the nature and scope of the incident and notified relevant law enforcement authorities about the same.

“The investigation determined that the unauthorised party accessed SRHS’s systems between December 19, 2025 and December 21, 2025. Through this investigation, on February 10, 2026, we learned that the unauthorised party had accessed certain SRHS files that contained patient information,” SRHS said.

The compromised data included names, contact information, Social Security numbers, driver’s license numbers, dates of birth, bank account information, health insurance information, provider names, internal patient identification numbers, dates of service, medication information, and treatment and/or diagnostic information.

In a filing with the U.S. Department of Health and Human Services Office for Civil Rights, SRHS said that it identified at least 53,888 individuals who were affected by the incident.

The healthcare provider has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general. 

The Anubis ransomware group did not state how much ransom it had demanded from Singing River Health System or whether the healthcare provider had established contact to negotiate a payment in exchange for the stolen data.