West County Health Centers, a community healthcare provider in western Sonoma County, California, was reportedly named by the Storm ransomware group. The organization has not confirmed a breach or what information was involved.
West County Health Centers’s Data Breach Investigation
West County Health Centers is a community-based healthcare provider serving patients in western Sonoma County, California. According to a ransomware tracking report, a group calling itself Storm listed the organization on a dark web leak site, and the listing was first detected on September 30, 2026. A plaintiff-side investigation listing also reports that the group claimed responsibility for a cybersecurity incident involving the organization.
That listing is essentially the only public information available right now. West County Health Centers has not publicly confirmed that a breach occurred, and we have not seen a breach notice, a filing with a state Attorney General, or a statement from the organization describing what systems or records were affected. The categories of information involved and the number of people affected have not been disclosed. Nothing on this page should be read as confirmation that any person’s information was taken.
A leak-site listing is a claim made by the group that posted it. Ransomware groups commonly name victims publicly to pressure them into paying, and they may later release files they say they copied. Some claims turn out to be accurate and others are overstated, so it can take weeks or months for an organization to finish its own investigation and tell the public what happened. State and federal notification deadlines generally run from the organization’s own confirmation of a breach, not from the date an attacker posts a claim.
The kind of organization involved matters. Community health centers keep registration and intake records, medical histories, treatment notes, medication and lab information, insurance details, billing records, and the contact information of patients and their families. Patient records of this kind are a frequent target because a single file can combine identity details with health and financial information. We do not know which categories of information, if any, were involved here, and we are not guessing.
If West County Health Centers does confirm that personal information was involved, state data breach laws generally require notice to affected individuals within set deadlines, and many states also require notice to the Attorney General when a certain number of residents are affected. Federal health privacy rules can also require notice to patients and to the Department of Health and Human Services when protected health information is exposed. Notification letters usually explain what happened, what information was involved, what the organization is doing in response, and what steps a person can take.
Identity and health details can support fraud such as opening accounts in another person’s name, submitting false insurance claims, or sending convincing phishing messages that reference a real care relationship. These are general risks associated with this type of incident, not confirmed facts about what happened to any individual’s data here.
We will update this page if West County Health Centers or a regulator publishes more detail, such as the dates of any incident, the data types involved, or the number of people notified. If you are a current or former patient or employee, there is no need to wait for a letter before taking basic precautions, such as reviewing your statements and explanation-of-benefits notices and considering a fraud alert or credit freeze.
Healthcare organizations remain one of the most heavily targeted sectors for ransomware because patient records are valuable and because clinics often cannot afford long outages. Attackers frequently copy files before locking systems, which is why a public listing can signal that data was removed even when no systems appear disrupted. Again, that is general background about the sector, not a confirmed detail about this organization.
When Did This Breach Occur?
The ransomware group’s listing was reportedly first detected on September 30, 2026. West County Health Centers has not confirmed the dates of any incident, when it was discovered, or when any notification may go out.
What Information Was Breached?
The specific types of information involved have not been disclosed, and the organization has not confirmed that any information was taken. Healthcare providers can hold names, contact details, dates of birth, insurance and billing information, and clinical records. Which of these, if any, were involved here is unknown.
What You Can Do
If you are a current or former patient or employee of West County Health Centers, consider these steps:
- Watch your mail and email for any notification from West County Health Centers and keep it for your records.
- Review your bank and card statements and your health insurance explanation-of-benefits notices for anything you do not recognize.
- Check your credit reports for free at annualcreditreport.com and consider a fraud alert or credit freeze with Equifax, Experian and TransUnion.
- Be cautious of calls, texts and emails that mention your care, billing or insurance, and avoid clicking links in unexpected messages.
- Report suspected identity theft to the Federal Trade Commission and your state Attorney General.
File a Data Breach Lawsuit Against West County Health Centers
If you received a notice that your information may have been involved in a West County Health Centers data breach, or you believe your information was put at risk, you may be entitled to compensation. Healthcare providers are expected to take reasonable steps to protect patient records, and people affected by a breach can face a lasting risk of identity theft and fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
