Survival Flight Inc.

On July 17, 2025, Survival Flight Inc., an emergency medical transportation company, discovered a cybersecurity breach compromising its IT systems. The investigation confirmed that personally identifiable information (PII) and protected health information (PHI) of patients were exposed, including names, addresses, health insurance details, medical treatment records, and potentially Social Security numbers and payment information. The hacking group Worldleaks later claimed responsibility on September 12, 2025, leaking the data on the dark web via the Tor network. The breach poses severe risks, including identity theft, financial fraud, and unauthorized access to sensitive medical data, with long-term reputational and operational consequences for the company. Survival Flight has initiated containment measures, notified law enforcement, and set up a dedicated call center for affected individuals, but the full extent of the damage—including potential regulatory penalties and loss of patient trust—remains under assessment.

Source: https://www.claimdepot.com/data-breach/survival-flight-2025

TPRM report: https://www.rankiteo.com/company/global-medical-response

"id": "glo1632216091725",
"linkid": "global-medical-response",
"type": "Cyber Attack",
"date": "7/2025",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'industry': 'Healthcare (Emergency Medical '
                                    'Transportation)',
                        'name': 'Survival Flight Inc.',
                        'type': 'Private Company'}],
 'customer_advisories': ['Dedicated call center: 1-833-844-8218 (Mon-Fri, 8 '
                         'AM–8 PM EST)',
                         'Future notifications to impacted individuals with '
                         'protective resources'],
 'data_breach': {'data_exfiltration': True,
                 'personally_identifiable_information': ['Names',
                                                         'Addresses',
                                                         'Health insurance '
                                                         'details',
                                                         'Medical treatment '
                                                         'information',
                                                         'Potential: Social '
                                                         'Security numbers'],
                 'sensitivity_of_data': 'High (includes medical and financial '
                                        'data)',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Protected Health Information '
                                              '(PHI)']},
 'date_detected': '2025-07-17',
 'date_publicly_disclosed': '2025-08-12',
 'description': 'On July 17, 2025, Survival Flight Inc. discovered a '
                'cybersecurity incident impacting its IT systems, compromising '
                'personally identifiable information (PII) and protected '
                'health information (PHI) of patients. The hacking group '
                'Worldleaks later claimed responsibility and leaked sensitive '
                'data on the dark web.',
 'impact': {'brand_reputation_impact': 'High (sensitive PII/PHI exposed, dark '
                                       'web leak)',
            'data_compromised': ['Names',
                                 'Addresses',
                                 'Health insurance details',
                                 'Medical treatment information',
                                 'Potential: Social Security numbers',
                                 'Potential: Payment information'],
            'identity_theft_risk': 'High (PII/PHI exposed)',
            'payment_information_risk': 'Potential (under review)',
            'systems_affected': ['Information Technology (IT) systems']},
 'initial_access_broker': {'data_sold_on_dark_web': True,
                           'high_value_targets': ['Patient PII/PHI']},
 'investigation_status': 'Ongoing (review may uncover additional exposed data)',
 'ransomware': {'data_exfiltration': True},
 'recommendations': ['Monitor financial accounts and credit reports for '
                     'identity theft',
                     'Place fraud alerts or credit freezes with major credit '
                     'bureaus',
                     'Beware of phishing (unsolicited emails/calls requesting '
                     'personal information)',
                     'Review notices from Survival Flight for updates'],
 'references': [{'date_accessed': '2025-08-12',
                 'source': 'Survival Flight Inc. Notice of Security Incident'},
                {'date_accessed': '2025-09-12',
                 'source': 'Worldleaks Dark Web Post'}],
 'response': {'communication_strategy': ['Notice of Security Incident '
                                         'published on website (2025-08-12)',
                                         'Dedicated call center for affected '
                                         'individuals (1-833-844-8218)',
                                         'Future notification to impacted '
                                         'individuals with resources for '
                                         'protection'],
              'containment_measures': ['Incident containment actions '
                                       '(unspecified)'],
              'incident_response_plan_activated': True,
              'law_enforcement_notified': True},
 'threat_actor': 'Worldleaks',
 'title': 'Survival Flight Inc. Cybersecurity Incident (2025)',
 'type': 'Data Breach'}