# Chaos Ransomware Group Claims 235GB PHI/Internal Document Leak from Healthcare Highways (Unconfirmed)

> On August 4, 2026 the Chaos ransomware-as-a-service (RaaS) group posted healthcarehighways.com to its Tor leak site, claiming exfiltration of 235GB of company and client records — including SSNs and health-insurance claims data — from Healthcare Highways, Inc. (HCH), a Frisco, TX-based network administrator serving 12,000+ primary care physicians, 69,000+ specialists, and 3,000+ facilities across TX, OK, LA and OH. A 24-hour contact deadline was set before threatened publication. HCH has not confirmed the breach.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2045
- **ID:** TL-2026-2045
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Chaos
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Chaos is a ransomware-as-a-service group first observed in early-to-mid February 2025 that Cisco Talos assesses, with moderate confidence, is likely operated by former members of the BlackSuit/Royal gang following a July 24, 2025 DOJ-led international law-enforcement action that seized BlackSuit's infrastructure — based on matching encryption command-line parameters (/lkey, /encrypt_step, /kill_vms), ransom-note structure, and toolset overlap. Chaos runs opportunistic, big-game-hunting double (and observed triple/quadruple) extortion operations, advertising affiliate recruitment on the Russian-language RAMP (Ransom Anon Market Place) forum, and per its own operator statements avoids BRICS/CIS countries, hospitals, and government entities as targets — notable here because Healthcare Highways is a healthcare network *administrator* rather than a direct hospital operator.

On 2026-08-04 at 15:57 UTC, Chaos posted a leak-site entry for healthcarehighways.com claiming 235GB of 'sensitive company and client records' were taken, with a 24-hour countdown for corporate contact before threatened publication; dark-web trackers (ransomware.live) and OSINT aggregators (RedPacketSecurity) subsequently indexed and republished the claim. Follow-on legal reporting (ClassAction.org, Levi & Korsinsky, Bryson Harris Suciu & DeMay PLLC) describes the allegedly compromised data as including names/contact information, Social Security numbers, and health/medical information tied to health-insurance claims processing — consistent with HCH's role administering employer health plans and provider networks. As of 2026-08-17, Healthcare Highways has not confirmed or denied the incident, no ransom amount specific to this victim has been disclosed, no data sample or leak publication has been observed, and no CVE/initial-access vector has been confirmed for this specific intrusion.

Because the intrusion vector for the HCH claim itself is not yet confirmed, the MITRE ATT&CK techniques below reflect Chaos's well-documented group-level tradecraft (Cisco Talos, AttackIQ, Rapid7) rather than victim-specific forensic findings: initial access via spam-flood-driven voice phishing (vishing) that walks victims into launching Microsoft Quick Assist for attacker-controlled remote access; persistence and lateral movement via abused legitimate RMM tools (AnyDesk, ScreenConnect, Splashtop, Syncro RMM, OptiTune) and RDP; command execution via PowerShell, WMI, and Impacket's atexec; data exfiltration using the legitimate GoodSync file-sync utility renamed to masquerade as wininit.exe; and impact via selective ECDH(Curve25519)+AES-256 file encryption (appending .chaos, dropping readme.chaos.txt) preceded by Volume Shadow Copy deletion. Analysts should also be aware that at least one unrelated Chaos-branded intrusion was assessed by Rapid7 (2026-05-06) as a false-flag operation by the Iranian APT MuddyWater (Seedworm) — underscoring that 'Chaos' leak-site attribution alone does not guarantee a single consistent actor or toolset behind every claim carrying the brand, and reinforcing why this HCH claim remains treated as unconfirmed pending forensic corroboration.

## MITRE ATT&CK

- T1566.004 Phishing: Spearphishing Voice
- T1078 Valid Accounts
- T1133 External Remote Services
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.002 At
- T1047 Windows Management Instrumentation
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1057 Process Discovery
- T1135 Network Share Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1005 Data from Local System
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1219 Remote Access Tools
- T1490 Inhibit System Recovery

## Sources

- [Healthcare Highways Data Breach? Lawyers Investigate Hackers' Claims](https://www.classaction.org/data-breach-lawsuits/healthcare-highways-august-2026)
- [Victim: healthcarehighways.com – chaos](https://ransomware.live/id/aGVhbHRoY2FyZWhpZ2h3YXlzLmNvbUBjaGFvcw==)
- [Chaos Ransomware: RaaS Resurgence & Detection](https://www.attackiq.com/2026/07/16/chaos-ransomware/)
- [Unmasking the new Chaos RaaS group attacks](https://blog.talosintelligence.com/new-chaos-ransomware/)
- [Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware](https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/)
- [Chaos · RansomLook (group profile)](https://www.ransomlook.io/group/chaos)
- [Healthcare Highways Breach Lawsuit Investigation](https://consumer.zlk.com/data-breach/healthcare-highways/)
- [New Chaos Ransomware Emerges, Launches Wave of Attacks](https://www.infosecurity-magazine.com/news/chaos-ransomware-wave-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2045