AiHealth Listed by thegentlemen Ransomware Group

On November 24, 2025, Vietnamese online healthcare provider AiHealth appeared on the leak site of the ransomware group known as thegentlemen. The company, which helps customers locate doctors, book appointments, order medication, and arrange home nursing care, is claimed to have had internal files exfiltrated following a ransomware attack. Anyone who used the platform at www.aihealth.vn or provider.aihealth.vn may have personal medical and contact information now at risk.

What's Publicly Reported from Reporting

Public reporting indicates that thegentlemen listed AiHealth on its dark-web leak site on November 24, 2025. The data consists of internal files exfiltrated during a ransomware incident. Exact victim numbers remain unknown, and the precise contents of the files have not been independently verified by third parties. The company operates an online pharmacy network and provides tools for remote medical consultations and at-home healthcare services across Vietnam.

Why This Matters for You and Your Family

When a healthcare provider is breached, the information exposed often includes names, addresses, phone numbers, dates of birth, national identification numbers, and details of medical conditions or prescriptions. For you or your family, this can lead to targeted fraud, insurance abuse, or phishing emails that appear to come from a doctor or pharmacy you actually used. Medical data is especially sensitive because it can be used to impersonate you when dealing with insurers, government agencies, or even employers.

Credential leaks from healthcare portals frequently cascade into other accounts. If you reused the same password at AiHealth that you use for email, banking, or shopping, those accounts become immediate targets.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at one database. Once internal files leave the victim’s network, they can be sold, traded, or published in full. This creates long identity chains: an email from the AiHealth breach can be cross-referenced with gaming accounts, social-media handles, or family-member records. Children’s profiles linked to a parent’s email are especially vulnerable because gaming platforms often store chat logs, payment methods, and voice data that can be exploited for harassment or further extortion.

Available reporting describes how such leaks fuel doxxing campaigns that combine medical details with home addresses and phone numbers, making targeted scams or physical threats easier to execute.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes the group’s emergence to 2024. It has claimed responsibility for attacks on healthcare providers, logistics firms, and smaller enterprises. Typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of internal documents and deployment of ransomware. The group then demands payment and, if unpaid, publishes samples or full datasets on its leak site. Past victims have included organizations whose customer or patient records appeared in similar extortion campaigns.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the AiHealth breach.
• Rotate the password you used at AiHealth anywhere else it appears, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is flagged within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become entry points for doxxing chains when parent credentials are leaked.
• Let remediation specialists handle data-broker takedown requests and follow-up on any exposed records so you do not have to chase them yourself.

The AiHealth incident is a reminder that healthcare data breaches continue to surface long after the initial attack. Taking concrete steps now limits how far the exposed information can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts. One short forward-looking action today can prevent months of fallout tomorrow.