Ransomware victim disclosure
← All victimsTriValley Primary Care
listed as trivalleypc.com · Claimed by Groove · listed 5 years ago
Status timeline
- Listed
Oct 22, 2021
- Data leaked
At a glance
- Group
- Groove
- Status
- Data leaked
- Country
- United States
- Sector
- Technology
- Listed on leak site
- Oct 22, 2021
About the victim
AI dossier — public-source company profileTriValley Primary Care is a multi-location primary care physician group operating at least eight outpatient offices across southeastern Pennsylvania (Montgomery, Bucks, and surrounding counties). The practice provides preventive medicine, coordinated care, televisits, and nursing home services to a broad patient population. They accept Medicare and multiple insurance plans and emphasize continuity of care with local hospitals and specialists.
- Industry
- Primary Care Medical Practice
- Address
- 211 Telford Pike, Telford, PA 18969 (Franconia Office, one of eight locations across southeastern Pennsylvania)
- Employees
- 51-200
Attack summary
Severity: critical — The victim is a multi-site primary care medical practice holding protected health information (PHI) and Medicare data for a large patient population; data_published status indicates regulated medical and PII data has been exfiltrated and released, meeting the critical threshold.The Groove ransomware group has listed TriValley Primary Care with a disclosed status of 'data_published', indicating that data claimed to have been exfiltrated from the practice has been released or made available. No ransom amount or specific data volume was stated in the post.
Data the group says was taken
AI dossier — extracted from the leak post- Patient medical records
- Patient PII (names, addresses, dates of birth)
- Medicare/insurance information
- Referral and prescription records
- Billing and payment records
- Provider and staff information
Sources
- Victim sitetrivalleypc.com
Source
Indexed 5 years agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
