Ransomware victim disclosure
← All victimsHospice Savannah
Claimed by CMD ORGANIZATION · listed 3 days ago
Status timeline
- Listed
May 29, 2026
- Data leaked
At a glance
- Group
- CMD ORGANIZATION
- Status
- Data leaked
- Country
- US
- Sector
- Healthcare
- Listed on leak site
- May 29, 2026
- Data size
- 59 GB
What the group claims
Hospice Savannah provides comprehensive hospice and palliative care services to individuals facing serious illnesses, including specialized programs for pediatric patients and advanced cardiac care. Their services extend to in-home care, nursing home assistance, and inpatient hospice units, ensuring a dignified and comfortable end-of-life experience.
The leak post
captured from the group's siteIT Security organization est. 2026. Hospice Savannah provides comprehensive hospice and palliative care services to individuals facing serious illnesses, including specialized programs for pediatric patients and advanced cardiac care. Their services extend to in-home care, nursing home assistance, and inpatient hospice units, ensuring a dignified and comfortable end-of-life experience. Now-Forward is a non-profit organization based in Dallas that provides a range of essential services such as financial aid, medical and dental care, food, clothing, and ESL classes to low-income families. Established to effectively serve the urgent needs of the community, they have been a trusted resource for over 40 years, assisting residents facing unexpected life challenges. The organization supports their mission through donations, volunteer work, and partnerships with local entities, ensuring that 96% of their funds are directed toward client services. Their extensive offerings also include tax preparation and school supply assistance, enabling families to achieve greater stability and self-sufficiency. Stonehenge Therapeutic Community is dedicated to providing expert services to individuals, …
Screenshot of the leak post

Sources
Source
Indexed 3 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.
