iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Two separate U.S. healthcare data incidents—involving Sunflower Medical Group in Kansas and Community Care Alliance (CCA) in Rhode Island—were reported to affect more than 300,000 people combined. The total is a rounded aggregation, not the count from one breach. Rhysida claimed both attacks, but the evidence tying the group to each incident differs.
Why the headline says more than 300,000
The combined figure comes from contemporary reporting that put Sunflower Medical Group’s affected population above 220,000 and CCA’s just under 115,000. CCA’s later settlement agreement gives a more specific estimate: approximately 116,753 people whose information may have been impacted. These figures describe two organizations and two incidents, not one event. The later CCA estimate should not be treated as a revised combined total.
Massachusetts regulatory filings list 56 Sunflower residents and 1,675 CCA residents. Those are state-resident filing counts, not the organizations’ nationwide totals. (IT Pro’s March 2025 report; Massachusetts Office of Consumer Affairs and Business Regulation filings.)
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat happened at Sunflower Medical Group
Sunflower said it became aware of suspicious network activity on January 7, 2025. Its investigation found that an unknown third party had accessed systems on or about December 15, 2024, and copied files. Sunflower’s notice does not identify the intruder as Rhysida.
#1 Best Overall
The information potentially involved varied by person and could include names, addresses, dates of birth, Social Security numbers, driver’s-license numbers, medical information, and health-insurance information. Sunflower’s March 7, 2025 alert, as reported by IT Pro, said more than 220,000 patients were affected.
Sunflower said it notified affected people for whom it had valid mailing addresses and offered complimentary identity-theft protection to people whose Social Security or driver’s-license information was involved. At the time of its notice, it said it had no evidence that the information had been misused; that statement describes what the organization knew then, not a guarantee about what may have happened later. It also recommended vigilance, including checking account statements and credit reports. (Sunflower Medical Group notice; IT Pro report.)
What happened at Community Care Alliance
CCA’s settlement agreement describes an incident on or about July 29, 2024, in which an attacker accessed and acquired files containing unencrypted personal information. The agreement estimates that approximately 116,753 individuals may have been affected. Potentially involved information could include names, Social Security numbers, personal customer data, addresses, phone numbers, and credit-card information.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →IT Pro’s contemporary account also reported that exposed information could include diagnoses or conditions, lab results, medications, patient IDs, insurance information, provider names, or treatment information. Those categories were not necessarily involved for every person.
The settlement agreement describes proposed relief: reimbursement for documented losses, a pro-rata cash payment, and two years of credit monitoring and identity-restoration services. It also says CCA denies the claims and any liability or wrongdoing. Court approval was required, and the agreement contains placeholder notice dates; it does not establish whether a claim can be filed now or whether benefits remain available. Check the current settlement administrator notice or court docket before relying on any deadline or eligibility details. (IT Pro report; CCA settlement agreement.)
How strong is the Rhysida attribution?
IT Pro reported that Rhysida claimed the two attacks. CCA’s settlement agreement names Rhysida in describing its incident. Sunflower’s own notice, however, refers to an unknown third party and does not name the group. The distinction matters: an attacker’s claim and a legal agreement’s description are not the same as independent confirmation of responsibility in every incident.
A joint CISA, FBI, and MS-ISAC advisory says, “Rhysida has predominately been deployed against the education, healthcare, manufacturing, information technology, and government sectors since May 2023.” The advisory’s broader findings establish that Rhysida is an active ransomware actor targeting healthcare, but they do not prove that the group caused either of these specific incidents. (CISA, FBI, and MS-ISAC advisory.)
What patients should take from the disclosures
- Use the organization’s notice to determine whether you may be affected. The kinds of data involved varied by individual, so a general list of possible information is not a confirmation that every listed item was exposed for every patient.
- Take the offered protection that applies to you. Sunflower described complimentary identity-theft protection for people whose Social Security or driver’s-license information was involved. CCA’s agreement described proposed monitoring and restoration benefits, but current availability and claim deadlines are not established by that agreement.
- Monitor relevant accounts and records. Sunflower recommended checking account statements and credit reports. Be alert to unexpected account activity or communications that use personal or health details.
- Do not assume the combined number means your records were involved. It is an aggregate across two organizations; whether an individual was affected depends on their relationship with Sunflower or CCA and the organization’s notices.
Because incident estimates, misuse disclosures, and settlement status can change, check the organizations’ current notices and, for CCA benefits, the settlement administrator or court record for the latest verified information.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
