Advanced Medical Consultants Listed by dragonforce Ransomware Group

On May 14, 2026, the ransomware group DragonForce added Advanced Medical Consultants to its leak site and began publishing what it claims are 2.3 million lines of full patient data along with partner agreements, management, payroll, and HR files.

Reported Details of the Incident

Public reporting indicates the attackers exfiltrated internal files during a ransomware operation against the healthcare consultancy. The group has stated it will release 1,000 lines of patient data each day until payment is received or an announced timer expires. A first batch was posted under the filename ADI-Day1.zip, with fresh archives promised daily. The precise number of individuals whose records were taken remains unknown, but the volume suggests thousands of patient files may be exposed.

Available reporting describes the material as containing sensitive medical information that, in many cases, includes names, dates of birth, Social Security numbers, diagnosis codes, treatment records, and insurance details. Payroll and HR documents add employment records, salaries, and internal correspondence that could be used for identity theft or further targeting of staff.

Why This Matters for You and Your Family

When a healthcare provider or consultancy loses control of patient records, the consequences reach far beyond the company. If you or any member of your family has ever received treatment, consultation, or lab work connected to Advanced Medical Consultants, your protected health information may now sit in an attacker’s archive. That data is valuable on underground markets because it combines medical details with personally identifiable information that can be used for insurance fraud, prescription scams, or blackmail.

Patient data rarely stays isolated. Once it appears in one leak, it is quickly cross-referenced with other breaches. A single exposed medical record can link your name and address to email accounts, phone numbers, and financial details harvested elsewhere. For families this means children’s records, spouses’ records, and even elderly parents’ records can all become part of the same chain of exposure.

The Doxxing and Identity-Chain Risks

Medical breaches create unusually long identity chains. Patient files often list home addresses, phone numbers, emergency contacts, and employer information. Attackers combine these details with usernames discovered in gaming platforms, social media, or older breaches to build a complete profile. The result is doxxing that can escalate from leaked medical history to harassment, swatting, or targeted scams against every member of a household.

Credential leaks that accompany ransomware incidents frequently cascade into account takeovers. Passwords or hints reused from healthcare portals are tried against email, banking, and gaming services. Children’s gaming accounts are especially vulnerable because parents often share or reuse credentials across family devices. Once an attacker controls a child’s Discord, Roblox, or Fortnite account tied to the same email or phone number listed in a medical file, the doxxing chain grows rapidly.

DragonForce’s Publicly Known Track Record

Public reporting attributes the current attack to the DragonForce ransomware group. The group emerged in late 2023 and has since claimed responsibility for dozens of incidents, primarily targeting mid-sized businesses and healthcare organizations. Notable prior victims include healthcare providers and professional service firms whose internal documents were published on leak sites after ransom demands went unpaid.

The group’s typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. Extortion combines data leaks with daily incremental releases to increase pressure. DragonForce often uses clear deadlines and begins publishing small samples to demonstrate the authenticity and sensitivity of the stolen material.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to the Advanced Medical Consultants breach.
• Rotate any password you ever used at Advanced Medical Consultants or related healthcare portals, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after medical data leaks.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal records found on data broker sites or underground forums.

The incident shows that healthcare data breaches continue to accelerate and that waiting for notification letters is no longer sufficient. One practical step taken now can break the chain before attackers turn stolen patient records into long-term identity theft or harassment. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one.