Ransomware victim disclosure
← All victimsXpress Nebs (Pediatric Products, LLC)
listed as xpressnebs.com · Claimed by LockBit · listed 3 months ago
Status timeline
- Listed
Feb 23, 2026
- Data leaked
At a glance
- Group
- LockBit
- Status
- Data leaked
- Country
- Germany
- Sector
- Healthcare
- Listed on leak site
- Feb 23, 2026
About the victim
AI dossier — public-source company profileXpress Nebs, operating as Pediatric Products, LLC, is a JCAHO-certified Durable Medical Equipment company based in Cincinnati, Ohio. The company specializes in supplying nebulizers, compressors, and respiratory accessories to the pediatric respiratory community across Ohio, Indiana, Kentucky, Arkansas, West Virginia, and Tennessee. It operates a stocking program that places equipment directly in clinics and physicians' offices for immediate patient distribution.
- Industry
- Durable Medical Equipment (Pediatric Respiratory)
- Address
- 2975 Exon Avenue, Cincinnati, OH 45241
Attack summary
Severity: critical — The victim is a JCAHO-certified DME healthcare provider serving pediatric patients; data_published status confirms exfiltration has occurred, and the data almost certainly includes regulated patient health information (PHI) protected under HIPAA, constituting a critical-severity breach of sensitive medical data at scale.LockBit claims to have attacked Xpress Nebs and has published data (disclosed status: data_published), indicating exfiltration of company data. Given the company's healthcare focus serving pediatric patients, the compromised data likely includes patient and medical records.
Data the group says was taken
AI dossier — extracted from the leak post- Patient records
- Medical equipment orders
- Physician/clinic contact information
- Business operational data
- Potentially protected health information (PHI)
What the group claims
Xpress Nebs is a JCAHO certified Durable Medical Equipment company that specializes in providing hig...
Sources
- Victim sitexpressnebs.com
Source
Indexed 3 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
