Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group Active in the last 30 days

Insomnia ransomware

59 victims listed on the Insomnia leak site across 4 countries. Most recent disclosure .

Victims
59
0.2% of all tracked
Countries
4
Most: United States
Sectors
11
Most: Healthcare
First seen
Feb 2026
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Insomnia and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Insomnia is a data-theft and extortion group targeting US healthcare organizations, stealing patient files and extorting public exposure for 59 victims across four countries.

Who Insomnia is

Insomnia is a data-theft and extortion group that emerged in October 2025, targeting primarily US-based healthcare organizations — stealing patient files and threatening public exposure rather than encrypting files — and avoiding former Soviet states, consistent with Russian-speaking cybercrime norms.

Recorded activity

Disclosures attributed to Insomnia in this database run from February 2026 to October 2026, totalling 59 victims — 0.2% of everything tracked here. Insomnia has listed victims in 4 countries in this database, most often United States, followed by Singapore and Brazil. The sectors appearing most in its listings are Healthcare, Business Services, Professional Services.

YARA detection rules

insomnia.yar 
/*
insomnia ransomware
*/

rule insomnia_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.insomnia"
        description = "Detects insomnia ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "insomnia" ascii nocase
        $name2 = "INSOMNIA" ascii
        $onion  = "insomnia.onion" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Insomnia, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Insomnia has disclosed 59 victims on its leak site, 0.2% of all ransomware listings tracked in this database. Its earliest disclosure here dates to February 2026.

The group has listed organisations in 4 countries, most often in United States (56 victims), followed by Singapore, Brazil, Panama.

By industry, its listings concentrate in Healthcare, Business Services, Professional Services — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Insomnia is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Insomnia victims 59

Organization Disclosed
Praxis EMR
USUnited States
Praxis EMR
USUnited States
Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC
USUnited States
Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC
USUnited States
Massey, Stotser & Nichols
USUnited States
Massey, Stotser & Nichols
USUnited States
Metropolitan Community Health Services
USUnited States
Metropolitan Community Health Services
USUnited States
NorthShore Health Centers
USUnited States
NorthShore Health Centers
USUnited States
Maglin, Miskiv & Associates
USUnited States
N***************
USUnited States
N***************
USUnited States
Metro Tulsa Foot
USUnited States
Aurora Health Management
USUnited States
***********
USUnited States
Codinter
USUnited States
Park Place Behavioral Health Care
USUnited States
Laempe Reich
USUnited States
Merritt Woodwork
USUnited States
Sky Solutions
PAPanama
Brooklyn Defender Services
USUnited States
*************
USUnited States
The Vant Group
USUnited States
Mid-Cumberland Human Resource Agency
USUnited States
Nephrology Associates
USUnited States
METO Systems
USUnited States
United Medical Doctors
USUnited States
Noble Inc.
USUnited States
*****d **d**** ****o**
USUnited States
Atlas Ocean Voyages
USUnited States
Valley Family Health Care
USUnited States
**l** ****** ****** C***
USUnited States
Belmont Plastic Surgery
USUnited States
Ripple Neuro
USUnited States
Thrash Commercial Contractors
USUnited States
Zaner Group
USUnited States
AdMark Asia Group
USUnited States
Application Solution Providers
USUnited States
Copier Careers
USUnited States
The Syverson Group
USUnited States
Aviam Corporate Housing
USUnited States
Advanced Healthcare Professionals
USUnited States
Anatomic Clinical Laboratory Associates
USUnited States
Carlyle Senior Care of Florence
USUnited States
Chiarottino
BRBrazil
DeVal LCS
USUnited States
Dunn and Dunn
USUnited States
Enviro-Hub Holdings
SGSingapore
Flint Hills Dialysis
USUnited States
Gruel Mills Nims Pylman
USUnited States
Integrated Fresh Solutions
USUnited States
Internal Medicine of Milford
USUnited States
Optimum Health Institute
USUnited States
Parts Life, Inc
USUnited States
Rella Associates
USUnited States
SchureMed
USUnited States
Southern Illinois Dermatology
USUnited States
Tri-Cities Gastroenterology
USUnited States

Frequently asked questions

What is Insomnia ransomware?

Insomnia is a ransomware threat group that has claimed 59 victims since its first known activity in February 2026. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Insomnia attacked?

Insomnia has claimed 59 victims in our database, representing 0.2% of all tracked ransomware attacks. The most targeted countries are United States, Singapore, Brazil, Panama.

Which countries does Insomnia target?

Insomnia has attacked organizations in 4 countries. The top targeted countries are: United States, Singapore, Brazil, Panama.

Which industries does Insomnia target?

Insomnia most frequently targets the Healthcare, Business Services, Professional Services sectors based on victim disclosures in our database.

Is Insomnia still active?

Insomnia's most recent victim disclosure in our database was on October 5, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.