Ransomware
Green Clinic ransomware locks a clinic out of its records
Ransomware encrypted a Louisiana clinic's network and medical records on October 2. What is confirmed, what is not, and a readiness plan for small clinics.
Green Clinic, a multi-specialty practice in Ruston, Louisiana, found a cybersecurity incident at about 6:30 a.m. on Friday, October 2, and shut down its computer and network operations. In a statement dated October 8 it said the attack was ransomware tied to a threat actor calling itself "Wall Street", or an affiliate, and that it "encrypted files and systems throughout our network". Staff lost access to many of their electronic systems, including patients' electronic medical records. The clinic has notified the FBI and the Cybersecurity and Infrastructure Security Agency (CISA), and is still investigating whether patient information was accessed or taken.
The clinic, owned by Allegiance Health Management since November 2024, planned to restart broader patient care on October 14 on a new clinical system, without its historical records or appointment lists. That is twelve days of very limited care for a practice that serves patients across North Louisiana. A small practice with one EHR (electronic health record) system, one network and one IT provider can be stopped in the same way.
What is confirmed, and what is not
The clinic's own statement is the firmest source. It confirms encryption across the network, loss of the medical record, outside incident responders and reports to the FBI and CISA. It does not say how the attackers got in, whether data left the network or how many patients are affected, and the clinic says it will not speculate until the investigation is done.
The Lincoln Parish Journal reported a "digital infrastructure disruption" at the clinic on October 6 and a cyberattack on October 7, a day before the clinic's statement, citing anonymous sources inside the clinic. Those sources said the records include medical histories, insurance details and credit card information, and that the clinic has no backups of them. Neither claim has been confirmed by the clinic, and the Journal said it had not confirmed whether records were stolen, deleted or only made inaccessible. The clinic's plan to start on a new system rather than restore the old one fits either explanation, so treat both claims as unconfirmed.
Dates differ by source. The clinic dates the attack to October 2. SOCRadar records Wallstreet's leak-site claim on October 14 and Breachsense lists it on October 15. Those are the dates the group posted the clinic as a victim on its leak site, not the date of the intrusion. No source has published the size of the stolen data or a ransom amount. A figure of 270,000 Louisiana patients circulating in some search results comes from a 2022 attack on Lake Charles Memorial Health System, not this incident.
The credential lead
SOCRadar says its stealer-log data held two records tied to the clinic's domain before the claim. Stealer logs are bundles of saved passwords and session cookies that infostealer malware copies from an infected browser and sells. The record it describes is a clinic email account whose credentials for lexmark-printer.net, a third-party printer management portal, appeared in logs from November 2025 through March 2026. SOCRadar reads the four-month span as a sign the password was not changed.
SOCRadar presents this as context and does not say it was the way in. Breachsense separately counts 40 clinic accounts in 17 older breaches, 20 of them with plaintext passwords, and 12 in combo lists (lists of email and password pairs traded for credential stuffing), the latest dated August 3, 2026. It also says these may be unconnected to the attack.
Little is published about Wallstreet itself. SOCRadar counts 32 other victims in the 60 days before this claim, mostly in healthcare and professional services, in the United States, Sweden and the United Kingdom. Its other recent healthcare listings include Gibson Area Hospital in Illinois and St. Francis Healthcare in Hawaii. No vendor has documented its initial access methods, its encryption tool or its ransom notes with evidence from real intrusions.
What the twelve days show
The October 8 statement lists what the clinic could not do: see who was booked, contact patients, or open a patient's prior chart. Staff spent most of a week training on a replacement system, and patients were asked to bring their insurance card, identification and medication bottles. Each of those gaps is something a small practice can prepare for in advance.
A readiness plan for a small clinic
Before an attack
Keep at least one copy of the EHR database and its configuration offline or in immutable storage, meaning object-locked so it cannot be deleted before it expires, even by an administrator. Give the backup system its own login that is not part of the clinic's Windows domain. If the EHR is hosted by a vendor, ask in writing how they would restore your data after an attack on your own network, and how long it would take.
Run timed restore tests that include the EHR database as well as file shares, and write down how long each restore took.
Every evening, export the next two days of appointments and patient phone numbers to a device that is not on the network, such as an encrypted laptop kept in a locked drawer. Keep a paper downtime binder and blank forms at every front desk and nurses' station: registration, orders, prescriptions, a call tree of staff mobile numbers and the phone numbers of your EHR vendor, IT provider and cyber insurer.
After a credential exposure
If a threat-intelligence feed, your insurer or a vendor reports a staff credential in a stealer log, act on the account and the machine together.
- Reset the exposed password and sign out every session, then reset each vendor portal password that browser had saved, including printer, billing and remote support portals.
- If the clinic uses Microsoft 365, filter the Microsoft Entra ID sign-in logs for that user over the exposure period and look for new countries, new devices and legacy authentication.
- On domain controllers and servers, review Security log Event IDs 4720 (account created), 4728 and 4732 (member added to a security group) and 1102 (audit log cleared), and System log Event ID 7045 (new service installed, a common way to launch remote tools).
- Find the PC the infostealer ran on and re-image it. Resetting passwords on an infected machine hands the new ones to the same malware.
If it happens
Report once to the FBI at ic3.gov or through the local field office; CISA says a single report to the FBI, CISA or the Secret Service reaches the others. Keep a dated log of discovery, scope and every decision.
Under HIPAA, the Health Insurance Portability and Accountability Act, HHS (the US Department of Health and Human Services) treats ransomware encryption of protected health information (PHI) as a breach unless a documented risk assessment shows a low probability that it was compromised. Patient letters are due without unreasonable delay and no later than 60 calendar days after discovery. If 500 or more patients are affected, HHS is notified within the same window, and if more than 500 residents of one state are affected, prominent local media must be told too. Smaller breaches go in a log reported to HHS within 60 days after the end of the calendar year. Louisiana law adds its own 60-day deadline for residents, and the Attorney General must receive notice within 10 days of the patient letters going out.
Our security operations team follows up on leaked staff credentials and the sign-in and event log checks above, and our on-demand risk reduction work tests backups and downtime plans for practices like this one. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Green Clinic statement, October 8, 2026 (via ClassAction.org), Lincoln Parish Journal, October 7, Lincoln Parish Journal, October 8, ClassAction.org, SOCRadar, Breachsense, SOCRadar, St. Francis Healthcare, DeXpose, Gibson Area Hospital, I.T. Solutions, Lake Charles Memorial, 45 CFR 164.404, 45 CFR 164.408, HHS ransomware fact sheet summary, Haynes Boone, CISA, report ransomware, Louisiana Attorney General, data breach notification.