Ransomware victim disclosure
← All victimsRegional Family Medicine
Claimed by Karakurt · listed 3 years ago
Status timeline
- Listed
Jul 28, 2023
- Data leaked
At a glance
- Group
- Karakurt
- Status
- Data leaked
- Country
- United States
- Sector
- Healthcare
- Listed on leak site
- Jul 28, 2023
- Data size
- 5 GB
About the victim
AI dossier — public-source company profileRegional Family Medicine is a primary care medical group operating two clinic locations in the United States. The practice employs eight primary care physicians, four advanced practice nurses, and more than fifty additional nurses, technicians, and support staff. It provides family and primary care medical services to its patient community.
- Industry
- Primary Care / Family Medicine
- Employees
- 51-200
Attack summary
Severity: critical — Confirmed exfiltration and publication of regulated healthcare data including patient/staff medical records, Social Security numbers (PII), and financial records from a medical provider, constituting a HIPAA-covered breach of sensitive personal and medical information at scale.Karakurt claims to have exfiltrated over 5 GB of data including SQL database contents, medical staff records, Social Security numbers, medical reports, bank statements, invoices, confidential documents, and incident records; the status is listed as data_published indicating the data has been released.
Data the group says was taken
AI dossier — extracted from the leak post- Medical staff records
- Social Security numbers
- Medical reports
- Bank statements
- Invoices
- Confidential documents
- Incident records
- SQL database dump (5+ GB)
What the group claims
Regional Family Medicine is a primary care group comprised of two separate clinic locations, eight primary care physicians, four advanced practice nurses, and over fifty other nurses, technicians and support staff. There is some data on medical staff, ss numbers, medical reports, bank statements, invoices, some confidential docs, incidents. +5gb SQL.
Sources
Source
Indexed 3 years agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
