TLC Perinatal Ransomware Claim by genesis (Sep 2026)

Claim Summary

TLC Perinatal, a US-based healthcare services provider operating at tlcperinatal.com, has been listed on a dark web leak site by a threat actor operating under the name “genesis.” The group claims to have attacked the organization on or around September 30, 2026. The listing describes TLC Perinatal simply as “a provider of healthcare services.” No data volume, file samples, or proof-of-compromise artifacts have been publicly disclosed alongside the claim.

This report is based solely on the unverified leak site posting. Yazoul Security has not independently confirmed that any intrusion occurred, that any data was exfiltrated, or that the claim is authentic. Readers should treat every element below as an allegation.

Threat Actor Profile

The actor behind this claim is genesis, a ransomware brand with no established public research footprint. At the time of writing, Yazoul Security has no confirmed victim count, no documented tooling, and no published YARA rules or detection signatures tied to this group. That absence is itself a signal: genesis may be a rebrand of an existing operation, a low-volume affiliate, or an entirely new entrant attempting to build notoriety.

Because no known tools or tactics have been attributed to genesis, defenders cannot yet map this actor to a familiar intrusion pattern. There is no public evidence linking genesis to a specific initial access vector, encryption binary, or exfiltration utility. Any assessment of their capability at this stage would be speculation.

Alleged Data Exposure

According to the threat actor, TLC Perinatal is a healthcare services provider. The leak site entry does not specify what categories of data were allegedly taken, how many records are involved, or whether the data includes protected health information. The claimed data volume is listed as undisclosed.

Healthcare organizations are frequently targeted because of the sensitivity and resale value of patient records, but the absence of samples or a stated record count means there is currently no way to gauge the scale of any purported exposure. Claims of this kind are sometimes published before any data is actually staged, purely to pressure a victim into negotiating.

Potential Impact

If the claim is accurate, a healthcare provider could face regulatory scrutiny under HIPAA, notification obligations to patients and partners, and operational disruption to clinical services. Ransomware actors frequently pair encryption with data theft, so even a partial exfiltration could carry downstream risk.

However, no evidence has been produced to substantiate the claim. Ransomware groups routinely exaggerate or fabricate victim listings to inflate their reputation and accelerate payment. The lack of a data volume, samples, or a proof page is a notable weakness in this particular claim.

What to Watch For

• Whether genesis publishes data samples, a countdown timer, or a proof-of-compromise page.
• Any confirmation or denial from TLC Perinatal or its regulators.
• Whether the listing is removed, suggesting a settlement, or escalated.
• Reuse of genesis infrastructure or branding by other actors, which would suggest a rebrand.
• Healthcare sector peers reviewing third-party and vendor access as a precaution.

Organizations in the maternal and perinatal care space should verify backup integrity and review remote access controls regardless of this claim’s validity.

Disclaimer

This report reflects an unverified claim published by a ransomware group on a dark web leak site. Yazoul Security has NOT independently confirmed the intrusion, the data theft, the data volume, or the authenticity of any material associated with this listing. Nothing here should be treated as established fact. All statements attributed to the threat actor are allegations. For related coverage, see our /news/ and /advisory/ sections.