US Alerts on Gunra, Unlimited Breach Hits 3.8M

US agencies warned about Gunra, a ransomware-as-a-service group that uses double extortion and is being deployed against critical infrastructure organizations, including health care and public health entities, both in the United States and abroad.

What the alert said

The joint notice, released by CISA along with the FBI and other partners, points readers to detection and mitigation guidance designed to harden defenses against this ransomware family. The warning places Gunra within a broad target set that includes health care and public health, financial services and insurance, critical manufacturing and construction, transportation and logistics, government services and facilities, utilities, academia, media and communications, retail, and professional and nonprofit organizations.

The alert is not limited to the health sector. The technical advisory describes an operation with the ability to target government and critical infrastructure entities on several fronts, at a time when the ransomware-as-a-service model continues to enable campaigns across multiple industries.

The breach at Unlimited Technology Systems

In parallel, Unlimited Technology Systems confirmed that an intrusion at a commercial data center, which took place between Oct. 5 and Oct. 10, 2025, allowed unauthorized actors to maintain access for six days and exfiltrate personal, medical, and insurance data from more than 3.8 million patients. The notice posted on the HHS breach portal classifies the case as server network hacking and lists 3,803,750 affected individuals.

The company had initially reported a much smaller scope, about 500,000 people, but that estimate was revised upward after forensic analysis. Access to hosted systems was cut off while the investigation moved forward, and authorities were notified.

The compromised data includes full names, Social Security numbers, dates of birth, email addresses, physical addresses, phone numbers, demographic information, driver’s license scans and other government documents, insurance cards, intake forms, health plan policy numbers, claims and benefits information, medical record numbers, dates of service, and diagnosis data. The company said full medical records, medical images, and financial account numbers were not affected.

No ransomware group has claimed the attack so far. Unlimited Technology Systems said the precise origin of the incident and the intrusion methods remain unidentified, despite notification to HHS and the relevant authorities.

Impact on the health care supply chain

Unlimited Technology Systems operates as a business associate under HIPAA and provides revenue cycle services and software solutions to about 4,500 clinics and medical centers. Analysts cited by Health Recovery Support said that helps explain the ripple effect across the oncology ecosystem and other specialized providers, in a context of heavy dependence on a small number of IT vendors and shared commercial data centers.

Those analyses say the breach exposed the fragility of the US health care supply chain, where a single incident can affect thousands of clinics and providers connected to the same infrastructure.