Artemis discloses ransomware attack after weeks of unauthorized access

Artemis Healthcare, Inc., a Tennessee-based healthcare services company, issued formal notification letters dated December 23, 2025, informing individuals of a ransomware-related data security incident that may have involved their personal information.

What happened 

According to Artemis, the organization first detected suspicious network activity on May 31, 2025, which was later confirmed to be the result of a cybersecurity attack carried out by a ransomware group. Following detection, Artemis immediately implemented containment measures, including forcing password resets and terminating active user sessions, to secure its systems. 

Artemis also launched a comprehensive investigation with the support of third-party forensic cybersecurity specialists to determine the nature and scope of the intrusion. The investigation revealed that unauthorized access to Artemis’s network occurred over a nearly four-week period, from May 5, 2025, through May 31, 2025. During this time, threat actors may have accessed files stored on Artemis’s systems. 

As part of its response, Artemis conducted a detailed review of potentially impacted files to determine whether sensitive information was present. The investigation concluded on September 12, 2025, at which point Artemis determined that certain individuals’ data may have been affected, although the specific information varied by person and could include names and other personal data elements.

What was said 

According to ClaimDepot, “This incident is considered severe due to the length of unauthorized access, the involvement of a ransomware group, and the types of data at risk. The attackers’ ability to compromise the network for nearly a month increased the likelihood that sensitive information could be misused for identity theft or fraud.”

Why it matters 

Similar to Artemis, Yale New Haven Health (YNHHS) detected unusual network activity (March 8, 2025) and immediately launched an investigation with external cybersecurity experts, confirming unauthorized third-party access to its network. 

Both incidents involved unauthorized access over a defined window, delayed confirmation of the full scope of exposed data, and subsequent patient notifications weeks or months later, YNHHS notified patients publicly on April 11, 2025, and Artemis issuing letters on December 23, 2025, after concluding its investigation on September 12, 2025. As Connecticut’s largest healthcare system, YNHHS holds vast volumes of patient demographic and identifier data that are highly valuable for identity theft and medical fraud even when electronic medical records are not directly accessed.

See also: HIPAA Compliant Email: The Definitive Guide (2025 Update)

FAQs

What is a data breach?

A data breach occurs when unauthorized individuals access, acquire, or disclose sensitive or protected information.

Why are healthcare organizations frequent breach targets?

Healthcare entities store high-value personal and medical data that can be exploited for identity theft, fraud, and extortion.

How do most data breaches start?

Many breaches begin with phishing emails, stolen credentials, or exploitation of unpatched system vulnerabilities.