Suntree Internal Medicine Hit by INC RANSOM Ransomware Attack, Exposing Data of Nearly 10,000 Patients
Suntree Internal Medicine, a private internal medicine practice based in Melbourne, Florida, is under investigation following a ransomware attack that exposed the sensitive data of 9,810 individuals. The breach was discovered on September 28, 2025, after unusual activity was detected in the practice’s digital systems. Cybersecurity experts were brought in to secure the network and assess the scope of the incident.
The investigation revealed that unauthorized access to certain files occurred, potentially compromising personally identifiable information (PII). Affected data includes names, addresses, health insurance details, and medical treatment records. Notably, Social Security numbers, credit card information, and bank account details were not involved.
The ransomware group INC RANSOM claimed responsibility for the attack, posting about the breach on the dark web via the Tor network on October 1, 2025. Suntree Internal Medicine reported the incident to the U.S. Department of Health and Human Services (HHS) on June 18, 2026, confirming the total number of impacted individuals.
The law firm Shamis & Gentile P.A. is currently investigating potential legal claims for those affected, as victims may be eligible for compensation. Suntree Internal Medicine, founded in 2002 by Dr. Abe Hardoon, serves patients with primary care, chronic disease management, and diagnostic services through its team of thirteen providers and sixty-five employees.
Source: https://www.claimdepot.com/investigations/suntree-internal-medicine-data-breach-2026
Soriano Med cybersecurity rating report: https://www.rankiteo.com/company/soriano-med
"id": "SOR1787070498",
"linkid": "soriano-med",
"type": "Ransomware",
"date": "9/2025",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '9810',
'industry': 'Healthcare',
'location': 'Melbourne, Florida, USA',
'name': 'Suntree Internal Medicine',
'size': '13 providers, 65 employees',
'type': 'Private medical practice'}],
'data_breach': {'number_of_records_exposed': '9810',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (PII)',
'type_of_data_compromised': ['Names',
'Addresses',
'Health insurance details',
'Medical treatment records']},
'date_detected': '2025-09-28',
'date_publicly_disclosed': '2025-10-01',
'description': 'Suntree Internal Medicine, a private internal medicine '
'practice based in Melbourne, Florida, is under investigation '
'following a ransomware attack that exposed the sensitive data '
'of 9,810 individuals. The breach was discovered on September '
'28, 2025, after unusual activity was detected in the '
'practice’s digital systems. Cybersecurity experts were '
'brought in to secure the network and assess the scope of the '
'incident. The ransomware group INC RANSOM claimed '
'responsibility for the attack, posting about the breach on '
'the dark web via the Tor network on October 1, 2025.',
'impact': {'data_compromised': 'Personally identifiable information (PII) '
'including names, addresses, health insurance '
'details, and medical treatment records',
'identity_theft_risk': 'Potential',
'payment_information_risk': 'None (Social Security numbers, credit '
'card information, and bank account '
'details were not involved)'},
'investigation_status': 'Ongoing',
'ransomware': {'data_exfiltration': 'Potential',
'ransomware_strain': 'INC RANSOM'},
'references': [{'source': 'Incident disclosure'}],
'regulatory_compliance': {'legal_actions': 'Potential (Shamis & Gentile P.A. '
'investigating legal claims)',
'regulatory_notifications': ['U.S. Department of '
'Health and Human '
'Services (HHS) '
'reported on '
'2026-06-18']},
'response': {'third_party_assistance': 'Cybersecurity experts'},
'threat_actor': 'INC RANSOM',
'title': 'Suntree Internal Medicine Hit by INC RANSOM Ransomware Attack',
'type': 'Ransomware'}