INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Ascent Skilled Nursing Facilities Stole Data from Breach Victims

| 2026-08-24 19:23 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
On July 31, Asheville Beaverdam NC Opco LLC d/b/a Bear Mountain Health and Rehabilitation, Asheville Victoria NC Opco LLC d/b/a Elevate Health & Rehabilitation, and Asheville US Seventy NC Opco LLC d/b/a Swannanoa Valley Health and Rehabilitation collectively notified some of their residents that a threat actor had logged into their systems between November 25, 2025 and November 28, 2025. The three entities are affiliated with Ascent Healthcare Management but do not name the trusted vendor involved in the breach. Approximately 1,500 residents were affected by this incident, which may have included resident name, date of birth, home address, email address, driver’s license, Social Security number, patient account number, diagnosis, and other health information related to resident care. The threat actor accessed these systems using login credentials stolen from another trusted vendor, but the exact method used is not specified.
Technical Mitigations AI-generated
• Use a secure login system with multi-factor authentication to prevent the theft of credentials. • Regularly monitor for signs of data deletion attempts, such as unusual file access patterns or deleted files being restored from backups. • Implement a robust incident response plan that includes verifying the permanent deletion of sensitive data through multiple channels and not relying solely on self-reported assurances.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 44 IoCs Create Free Account
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
ww•••••.gov
pu•••••.required
be•••••.com
po•••••.org
se•••••.pdf
rs•••••.png
Be•••••.pdf
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth
Incident Timeline
‎2026/08/24
Threat actors leaked client data, tens of thousands of SSNs.
threat_actor ShinyHunters
…for data breach claims, MA appeals court says in a first * Personal Information Exposed in Apollo Global Data Breach * ShinyHunters provided no real proof they hacked ReliaQuest– because they didn’t get anywhere: ReliaQuest * Connecticut say…
data_breach 41,000 Medicaid members
…ShinyHunters provided no real proof they hacked ReliaQuest– because they didn’t get anywhere: ReliaQuest * Connecticut says data from 41,000 Medicaid members exposed in portal breach; the second portal incident this year * Troutman Pepper Locke
financial $2.5 analyst
Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs * Scammers Pose as NYPD Officers in “Well-Done” Video-Call Impersonation Scam * AI, Data Breaches, and an Old Lesson from the Law of Bailment * Largest Applebee’s franchisee s…
Tactical Metrics
Metrics
data_breach
41,000
Medicaid Members
…ShinyHunters provided no real proof they hacked ReliaQuest– because they didn’t get anywhere: ReliaQuest * Connecticut says data from 41,000 Medicaid members exposed in portal breach; the second portal incident this year * Troutman Pepper Locke
Metrics
financial
2,500,000
Analyst
Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNs * Scammers Pose as NYPD Officers in “Well-Done” Video-Call Impersonation Scam * AI, Data Breaches, and an Old Lesson from the Law of Bailment * Largest Applebee’s franchisee s…
Intelligence Sources
Data Breaches 2026-08-24