The November 4, 2026 HIPAA Journal report does not tie the Medusa ransomware group to the HCA Healthcare or Blossom Health breaches. Medusa's only claimed attack in the report is against the University of Mississippi Medical Center (UMMC), which the group claimed in March 2026. Neither HCA nor Blossom has named an attacker, and the source cites no leak site posting, regulatory filing, or researcher attribution linking either organization to Medusa.

The confirmed facts come from the organizations' own disclosures and state filings. HCA Healthcare, which operates 189 hospitals and about 2,600 ambulatory sites in 19 states, confirmed unauthorized access to certain IT systems on August 12, 2026. The attacker copied HR files holding medical resident Social Security numbers and immigration information, along with patient records from affiliated facilities and physician offices that included medical and health insurance details. HCA has reported 15,096 affected Texas residents and has not released a total count.

Blossom Health, a telepsychiatry provider, says an attacker phished a non-employee contractor in August 2026 and used that access to reach its electronic health record (EHR) software. The attacker downloaded a limited number of medical records and a user spreadsheet with patient names, contact details, and insurance information. Blossom reported 2,103 affected Texas residents to the state Attorney General. If your practice gives outside contractors EHR logins, this is the access path to note.

The UMMC case shows how Medusa operates. Attackers had access to UMMC's network from February 11 to February 19, 2026, and Medusa later demanded payment to prevent the sale or release of the stolen data. UMMC did not pay. This model, called double extortion (disrupting systems while also threatening to publish stolen files), means that restoring your systems from backups does not remove the data from the attacker's hands. Protected health information stays sensitive for years, so records taken from a provider can be sold or posted long after operations recover.

The sections that follow are written for healthcare providers, the vendors and business associates who hold access to their systems, and patients who received notification letters from HCA Healthcare, Blossom Health, El Camino Health, or UMMC.

How Medusa Ransomware Operates: Initial Access, Lateral Movement and Double Extortion

The source confirms one Medusa incident in this report. The group spent roughly eight days inside the University of Mississippi Medical Center network, from February 11 to February 19, 2026. It claimed the attack in March 2026 and demanded payment to prevent the sale or release of stolen data. The source gives no technical detail beyond that, so the tradecraft below comes from the CISA, FBI and MS-ISAC joint advisory AA25-071A. It describes the group's documented playbook and is not a forensic account of any breach named in this report.

Analysts often confuse three separate threats. Medusa is a ransomware-as-a-service (RaaS) operation, meaning its developers rent the ransomware to affiliates who carry out intrusions. MedusaLocker is an unrelated ransomware family with its own CISA advisory. The Medusa Android banking trojan targets mobile banking credentials and has no link to either. If your threat intelligence feeds merge these names, your indicator matching will produce misleading results.

According to AA25-071A, Medusa affiliates get in three ways:

• Phishing to steal credentials (T1566).
• Initial access brokers, criminals who sell working network access. Medusa recruits them on cybercrime forums (T1078, Valid Accounts).
• Exploitation of unpatched internet-facing systems (T1190), including the ConnectWise ScreenConnect authentication bypass CVE-2024-1709 and the Fortinet EMS SQL injection flaw CVE-2023-48788.

Buying access from brokers shortens the time between purchase and intrusion. A single exposed remote management server can be enough for an affiliate to start.

Once inside, affiliates rely on tools already present on the network or commonly used by IT staff. This approach is called living off the land. The advisory lists PowerShell and cmd.exe (T1059.001, T1059.003), network scanners for discovery (T1046), and legitimate remote access software such as AnyDesk, Atera, ConnectWise, Splashtop and PDQ Deploy(T1219). Because this activity looks like routine administration, it can blend into normal help desk traffic for days.

For defense evasion, the advisory describes obfuscated PowerShell and deletion of command history (T1027, T1070.003). Affiliates also attempt to disable endpoint detection and response (EDR) agents (T1562.001). One documented method is bring your own vulnerable driver (BYOVD). The attacker installs a legitimately signed but flawed kernel driver, then abuses it to terminate security processes from kernel level (T1068). The practical result is that security tooling can be switched off before encryption begins.

Data theft comes before encryption. AA25-071A reports that affiliates use Rclone, an open-source file synchronization tool, to copy data to attacker-controlled cloud storage (T1567.002). The encryptor, which the advisory identifies as gaze.exe, then encrypts files (T1486) and deletes Volume Shadow Copies (T1490), removing local Windows restore points. An organization that restores from offline backups still faces the stolen data problem. This is the double extortion model.

Medusa runs a public data leak site. Each victim's listing shows a timer for publication. The advisory states that victims are offered options to pay for deletion of the data, or to pay to extend the deadline, and that the data may also be sold to third parties. This matches the UMMC demand described in the source, which covered both sale and release. AA25-071A also documents a case where a victim was contacted by a second Medusa actor who claimed the original negotiator had stolen the ransom and requested another payment. For healthcare entities, published patient records create obligations to notify affected individuals and regulators whether or not a ransom is paid. UMMC did not pay.

What the Breaches Mean for Patients, Providers and HIPAA Obligations

The four disclosures expose very different data sets, so the risk to affected patients varies by organization. El Camino Health's file review found the broadest mix: Social Security numbers, driver's license numbers, medical record numbers, diagnoses, prescriptions, dates of service and health insurance details, plus financial account and routing numbers for a subset of patients. That combination supports opening new credit in a patient's name and also gives criminals what they need to attempt withdrawals from existing bank accounts.

HCA Healthcare's patient files paired Social Security numbers and dates of birth with medical and insurance information. Its medical residents also had immigration information exposed, which can be used to impersonate government agencies or employers in scams aimed at people on work visas. Blossom Health says Social Security numbers and financial data were not accessible. Its exposure (names, contact details and insurance information from a telepsychiatry provider) still carries risk, because insurance details enable medical identity fraud (billing care to someone else's policy), and the link to mental health treatment makes those patients easy to target with phishing that impersonates their provider.

If you are a covered entity, the HIPAA Breach Notification Rule requires you to notify affected individuals without unreasonable delay, within a fixed deadline that runs from the date of discovery. Breaches above the rule's size threshold must also be reported to HHS OCR and to prominent media outlets. State laws add their own requirements. HCA reported 15,096 Texas residents to the Texas Attorney General, and Blossom reported 2,103. Neither organization has published a total count. UMMC filed with the California Attorney General without listing data types or individual counts, and it has no substitute notice on its website.

Timelines draw regulatory attention. UMMC identified the intrusion on February 19, 2026, and confirmed the scope on October 20, 2026. Blossom sent letters on October 29 for an August incident. Your notification clock under HIPAA generally starts when you knew or reasonably should have known about the breach, so long investigations need documentation that justifies their length. The source reports no lawsuits against these organizations. Breaches that combine Social Security numbers with health data commonly draw class action filings and OCR inquiries.

None of the four disclosures reports an interruption to patient care. The costs fall elsewhere. Each organization paid for forensic investigation, a file-by-file review to identify whose data was involved, mailed notices and identity protection services. HCA offered two years of credit monitoring. Its incident also reached affiliated facilities and physician offices, which multiplies the parties that must coordinate notices. For your organization, the review and notification phase can run for months after containment and consume legal, compliance and IT staff time throughout.

Blossom's breach began with a phishing attack on a non-employee contractor whose access reached the EHR software. Any contractor or business associate holding credentials to your systems extends your exposure to their email security and training. Under HIPAA, a business associate must notify you of a breach it discovers, and you remain responsible for notifying your patients when your data is involved. El Camino's incident shows the same pattern at a smaller scale: four compromised Microsoft 365 accounts were enough to expose documents covering patient identity, treatment and finances.

Double extortion (copying data before encrypting systems, then threatening to publish it) changes how you weigh a ransom demand. Payment buys a criminal group's promise to delete stolen files, and you have no way to verify that deletion. The data has still been acquired by an unauthorized party, so your HIPAA and state notification duties apply whether you pay or not. UMMC declined to pay, and its notification obligations are proceeding the same way they would have otherwise.

Detecting and Containing Medusa Activity in Healthcare Environments

The most important step you can take this week is to close the remote access paths Medusa affiliates use to get in. CISA advisory AA25-071A names internet-facing ScreenConnect and Fortinet EMS servers among the entry points, so patch them to the vendor's current fixed release or pull them off the internet until you can. An unpatched remote management product gives an attacker a foothold that looks like routine IT administration in your logs.

The remaining actions follow CISA's layered defense model. They move inward from the perimeter to identity, endpoints and data, and they are ordered by urgency.

Within 24 to 72 hours, work through these checks:

• Inventory remote monitoring and management (RMM) tools. Search software inventories and process logs for AnyDesk, Atera and ConnectWise instances your IT team did not deploy. Flag PDQ Deploy jobs launched outside approved change windows, since the advisory describes Medusa operators using it to push payloads to many hosts at once.
• Hunt for bulk exfiltration. Review firewall and proxy logs for large, sustained uploads to cloud storage providers. Look for Rclone running from user profile or temp directories, often under a renamed binary. Theft happens before encryption in double extortion, so this traffic is usually the last warning before files lock.
• Check endpoint protection health. Alert when EDR agents stop reporting or their services stop unexpectedly. Also alert on newly loaded signed drivers with known vulnerabilities, which attackers load to terminate security tools from kernel level.
• Reset credentials and require phishing-resistant MFA. Rotate privileged and service account passwords. Enforce FIDO2 security keys or certificate-based authentication on VPN, remote desktop and email.

For cloud email, review sign-in logs for the same account authenticating repeatedly from unfamiliar locations, followed by mass file downloads. El Camino Health's attacker returned to its mailboxes intermittently across about a week. Alerting on that pattern can stop an intrusion before the attacker finishes copying documents.

Over the following weeks, build controls that make the next intrusion harder:

• Restrict PowerShell to administrators, enable script block logging, and use application control to allow-list the single RMM product you approve.
• Segment EHR and clinical systems from general IT and HR networks so one compromised workstation cannot reach patient records directly.
• Keep offline, immutable backups and run a full restoration test of at least one clinical system.
• Review every business associate and contractor account. Blossom Health's attacker reached its EHR through a phishing attack on a non-employee contractor, so outside users need the same MFA and access reviews as staff.

For the longer term, put incident response and breach counsel retainers in place before you need them. Write a HIPAA notification playbook that assigns owners for state attorney general filings, substitute website notices and patient letters. UMMC confirmed its breach scope months after detection, and its California filing listed neither data types nor affected counts. A prepared playbook shortens that gap. Run tabletop exercises built on a double-extortion scenario, including the ransom payment decision and the response to a leak site posting.

If you received a notice from HCA Healthcare or Blossom Health, place a credit freeze with Equifax, Experian and TransUnion. A freeze blocks new accounts in your name and costs nothing. Enroll in the monitoring offered in your letter. Read every explanation-of-benefits statement from your insurer and report any visits, prescriptions or equipment you never received, since that is how medical identity theft usually shows up. Expect breach-themed phishing emails and calls that reference the incident. Verify any request by calling the number listed on the organization's official website, and never give out a Social Security number to an unsolicited contact.

Key Takeaway for Healthcare Security Teams

The source ties only one of these four breaches to Medusa, the UMMC attack, and the HCA Healthcare and Blossom Health incidents remain unattributed in every public filing it cites. Treat any claim linking those two disclosures to Medusa as unconfirmed until one of the organizations or a regulator states it. What you can take from the report is that a single roundup covered four healthcare breaches reached through different routes, including a phishing attack on a contractor and a network intrusion that took until October 20 to fully scope.

Healthcare stays a priority for extortion groups like Medusa because one patient file can combine Social Security numbers, insurance details and clinical history. That mix supports identity fraud and gives attackers material to threaten publication, which is the pressure Medusa applied at UMMC. If you run a healthcare network, you hold the same categories of data these providers reported losing, so your exposure depends mainly on how easily an attacker can reach that data from outside.

The single most important action is to inventory every internet-facing remote access service and remote monitoring and management (RMM) tool in your environment, remove the ones you do not use, and keep the rest patched and protected with MFA. Medusa affiliates rely on these tools for initial entry and for keeping access afterward, so compare your findings against the current indicators of compromise in CISA advisory AA25-071A. If you cannot say with confidence which remote access tools are exposed or which vendors hold credentials to them, a security assessment of your remote access and third-party connections will give you that list to act on.