HealthConsent
Active breach tracker Northeast Tennessee Disclosed April 29, 2026

Tri-Cities Gastroenterology Data Breach 2026 (Insomnia Group): 67,115 Patients in 5 Northeast Tennessee Cities Exposed. Data Leaked. What To Do

Tri-Cities Gastroenterology, a five-office GI specialty group in northeast Tennessee (Kingsport, Johnson City, Elizabethton, Erwin, Greeneville), disclosed in April 2026 a December 2025 ransomware attack by the Insomnia group. Stolen data was leaked publicly after ransom non-payment. 67,115 patients affected. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Dec 11, 2025

Unauthorized third party accesses and removes files

Dec 11, 2025

Breach detected

Feb 7, 2026

Insomnia group adds Tri-Cities Gastro to leak site

Apr 22, 2026

Forensic review completes; PHI involvement confirmed

Apr 29, 2026

Filed with HHS OCR; individual letters mailed

Data exposed

01

High-risk identity

Enables financial + identity theft

Social Security number Date of birth

02

Health records

Don't expire and can't be reissued

Medical record number

03

Contact & insurance

Phishing + targeted scams

Full name Home address Email address Phone number Gender

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Shamis & Gentile (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Tri-Cities Gastroenterology, P.C. is a gastroenterology specialty group operating five clinics in the northeast Tennessee Tri-Cities region: Kingsport (10461 Wallace Alley St), Johnson City (2333 Knob Creek Rd), Elizabethton (1500 W Elk Ave), Erwin (105 Gay St), and Greeneville (1001 Tusculum Blvd). The practice operates the public-facing brand “Digestive Wellness.”

On December 11, 2025, an unauthorized third party accessed Tri-Cities Gastroenterology’s network and removed files. On February 7, 2026, the Insomnia ransomware / data-extortion group added the practice to its dark-web leak site, threatening publication of the stolen data. The practice did not pay the ransom; stolen data was subsequently posted to the Insomnia leak site.

The forensic review concluded on April 22, 2026. Tri-Cities Gastroenterology filed with HHS OCR and began mailing individual notification letters on April 29, 2026, confirming 67,115 affected individuals.

What was stolen

The exposed data includes:

  • Full name
  • Social Security number
  • Date of birth
  • Home address
  • Email address
  • Phone number
  • Gender
  • Medical record number

The notice does not specify whether clinical detail (diagnoses, procedure records, biopsy results) was in the exfiltrated dataset. Given the size of the Insomnia leak listing and the breadth of practice-management data Insomnia typically takes, treatment-history data is plausibly in scope.

What Tri-Cities Gastroenterology is offering

Complimentary credit monitoring is being offered to individuals whose Social Security number was involved. The vendor and duration were not disclosed in the public substitute notice. Dedicated call center: 844-558-4651 (Monday to Friday, 9 a.m. to 9 p.m. Eastern, excluding holidays).

What to do

  1. Enroll in the offered monitoring through the activation code in your letter.
  2. Place free credit freezes at Equifax, Experian, and TransUnion.
  3. File IRS Form 14039 to prevent fraudulent tax filings.
  4. Stop the ongoing flow of your gastroenterology data. HealthConsent files HIPAA restriction requests so the demographic and treatment-context data exposed in this breach is not continuously re-shared by downstream entities. Because Insomnia published the stolen data, your record is already in the wild.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.