cyfenced.com →

[ Ransomware claim · wallstreet · 14 Oct 2026 ]

Green Clinic

The ransomware group wallstreet named Green Clinic (United States) on its leak site on 14 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.

Confirmed by the organisation Healthcare

[ Status ]Has the attack been confirmed?

On 8 October 2026 Green Clinic said it had found a ransomware attack on 2 October associated with a threat actor calling itself Wall Street, that it had notified the FBI and CISA, and that its review of whether patient information was accessed was still ongoing.

[ The organisation ]Who is Green Clinic?

What it does
Green Clinic is a multi-specialty medical clinic in Ruston, Louisiana, offering primary, specialty and walk-in medical care. Its physicians, advanced practice providers and other healthcare professionals provide a broad range of outpatient services. Since November 2024 it has been owned by Allegiance Health Management and sits alongside Northern Louisiana Medical Center.
Based in
Ruston, Lincoln Parish, Louisiana, United States
Founded
1948
Size
three care sites in Ruston and a fourth in Hodge, according to press reporting
Who it serves
Patients in Ruston and across North Louisiana who need primary care, specialist care or walk-in treatment.

Partners and customers it names publicly

  • Allegiance Health Management, Owner since November 2024
  • Northern Louisiana Medical Center, Sister organisation under Allegiance Health Management

[ Impact ]Who could be affected

Patients have already faced cancelled or delayed appointments, longer visits and providers without access to earlier medical records while systems were restored, as the clinic itself described. If personal or health information was accessed, patients could later receive breach notifications and could be targeted by fraud or phishing. Local pharmacies, hospitals and referral partners that rely on records from the clinic could also see slower exchanges of information.

In healthcare generally: Patients are the first to feel it: appointments, prescriptions and test results can be delayed, and medical and insurance records are among the most sensitive data a group can threaten to publish.

[ The attacker ]About wallstreet

Wallstreet is a financially motivated ransomware group that appeared in 2026 and uses double extortion, stealing data before encrypting systems and threatening to publish it. Security researchers report its listed victims are mainly in the United States, including hospitals, schools and manufacturers.

wallstreet has claimed 19 organisations in the last 30 days, most in Sweden, United States and United Kingdom, and mostly in healthcare, professional services and manufacturing. We wrote about the group in Ports, a cloud host and a busy month for extortion.

wallstreet on Ransomware.live

Other organisations wallstreet has named

[ What to do ]If you are a customer, partner or neighbour

  1. Bring your insurance card, identification and an up-to-date medication list to appointments while the clinic rebuilds its records.
  2. Watch for a formal breach notification letter from the clinic and follow any steps it offers, such as credit or identity monitoring.
  3. Treat unexpected calls, texts or emails about your care, bills or payments with caution and check them by calling the clinic on a number you already know.
  4. Review explanation of benefits statements from your insurer for treatments or visits you do not recognise.
Researched with AI from the sources on this page on 26 Oct 2026. Facts can change: check the organisation's own announcements.

[ Similar claims ]Other healthcare organisations in United States