insomnia
First seen February 7, 2026Active58 claimed victims
The claims below are reproduced as posted by insomnia on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Insomnia is a data-theft and extortion group that emerged in October 2025, targeting primarily US-based healthcare organizations — stealing patient files and threatening public exposure rather than encrypting files — and avoiding former Soviet states, consistent with Russian-speaking cybercrime norms.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Praxis EMR | October 5, 2026 | ransomlook | — |
| Praxis EMR | September 17, 2026 | ransomware_live | — |
| Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC | September 15, 2026 | ransomlook | — |
| Massey, Stotser & Nichols | September 14, 2026 | ransomlook | — |
| Metropolitan Community Health Services | September 14, 2026 | ransomlook | — |
| NorthShore Health Centers | September 7, 2026 | ransomlook | — |
| Maglin, Miskiv & Associates | September 3, 2026 | ransomlook | — |
| N*************** | September 2, 2026 | ransomlook | — |
| Metro Tulsa Foot | August 31, 2026 | ransomlook | — |
| Metropolitan Community Health Services | August 24, 2026 | ransomware_live | — |
| *********** | August 19, 2026 | ransomware_live | — |
| NorthShore Health Centers | August 10, 2026 | ransomware_live | — |
| Maglin, Miskiv & Associates | August 7, 2026 | ransomware_live | — |
| Codinter | August 5, 2026 | ransomware_live | — |
| Metro Tulsa Foot | August 3, 2026 | ransomware_live | — |
| Aurora Health Management | July 27, 2026 | ransomware_live | — |
| Park Place Behavioral Health Care | July 23, 2026 | ransomware_live | — |
| Merritt Woodwork | July 15, 2026 | ransomware_live | — |
| Sky Solutions | July 5, 2026 | ransomware_live | — |
| Laempe Reich | July 1, 2026 | ransomware_live | — |
| ************* | June 25, 2026 | ransomware_live | — |
| Brooklyn Defender Services | May 29, 2026 | ransomware_live | — |
| Mid-Cumberland Human Resource Agency | May 18, 2026 | ransomware_live | — |
| The Vant Group | May 13, 2026 | ransomware_live | — |
| Nephrology Associates | April 6, 2026 | ransomware_live | — |
| *****d **d**** ****o** | March 31, 2026 | ransomware_live | — |
| United Medical Doctors | March 31, 2026 | ransomware_live | — |
| METO Systems | March 31, 2026 | ransomware_live | — |
| **l** ****** ****** C*** | March 7, 2026 | ransomware_live | — |
| Valley Family Health Care | March 7, 2026 | ransomware_live | — |
| Noble Inc. | March 4, 2026 | ransomware_live | — |
| Atlas Ocean Voyages | February 27, 2026 | ransomware_live | — |
| Belmont Plastic Surgery | February 24, 2026 | ransomware_live | — |
| Zaner Group | February 4, 2026 | ransomware_live | — |
| Thrash Commercial Contractors | February 2, 2026 | ransomware_live | — |
| Chiarottino | January 23, 2026 | ransomware_live | — |
| Enviro-Hub Holdings | January 19, 2026 | ransomware_live | — |
| Dunn and Dunn | January 8, 2026 | ransomware_live | — |
| Aviam Corporate Housing | January 8, 2026 | ransomware_live | — |
| The Syverson Group | January 8, 2026 | ransomware_live | — |
| Copier Careers | January 8, 2026 | ransomware_live | — |
| Application Solution Providers | January 8, 2026 | ransomware_live | — |
| AdMark Asia Group | January 8, 2026 | ransomware_live | — |
| Optimum Health Institute | December 22, 2025 | ransomware_live | — |
| SchureMed | December 19, 2025 | ransomware_live | — |
| Tri-Cities Gastroenterology | December 16, 2025 | ransomware_live | — |
| Flint Hills Dialysis | December 4, 2025 | ransomware_live | — |
| Rella Associates | December 4, 2025 | ransomware_live | — |
| Southern Illinois Dermatology | November 28, 2025 | ransomware_live | — |
| Anatomic Clinical Laboratory Associates | November 25, 2025 | ransomware_live | — |
| Gruel Mills Nims Pylman | November 10, 2025 | ransomware_live | — |
| Advanced Healthcare Professionals | November 6, 2025 | ransomware_live | — |
| Internal Medicine of Milford | November 5, 2025 | ransomware_live | — |
| Carlyle Senior Care of Florence | October 31, 2025 | ransomware_live | — |
| DeVal LCS | October 29, 2025 | ransomware_live | — |
| Parts Life, Inc | October 29, 2025 | ransomware_live | — |
| Integrated Fresh Solutions | October 8, 2025 | ransomware_live | — |
| Ripple Neuro | February 14, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).