artcitydental.com Listed by safepay Ransomware Group

On December 17, 2025, the dental practice artcitydental.com appeared on the leak site of the safepay ransomware group. The clinic, a family-oriented practice in Springville, Utah, is claimed to have had internal files exfiltrated during a ransomware attack. Public reporting indicates that patient and operational records were taken, although the exact number of individuals affected remains unknown.

Reported Details of the Breach

Available reporting describes the incident as a classic ransomware operation. The safepay group claims to have breached the clinic’s systems, copied sensitive internal files, and is now offering them for download on its dark-web leak page. The data types exposed include documents that would typically contain names, addresses, dates of birth, treatment records, insurance details, and possibly Social Security numbers for patients and staff.

December 17, 2025 marks the public listing date. No ransom payment deadline has been publicly confirmed in the available reporting, but ransomware groups routinely set short windows before releasing or selling the stolen data. The clinic has not yet issued a public statement confirming the breach scope or notifying patients, which is common in the early days after a listing appears.

Why This Matters for You and Your Family

When a local dental clinic is hit, the impact lands directly on ordinary families. If you or your children have ever been patients at Art City Dental, your personal health information and contact details may now sit on a ransomware leak site. That information can be used for identity theft, insurance fraud, or targeted scams that feel personal because attackers know where you live and what medical care you received.

Patient records and insurance details are especially valuable to criminals. A single breach like this can expose an entire household if family members share the same address or phone number. Even if you were not a patient, the incident shows how quickly everyday local businesses that hold your data can become targets.

The Doxxing and Identity-Chain Risks

Stolen dental files rarely stay isolated. Attackers or buyers frequently combine them with other leaked data to build detailed profiles. A name and address from a patient record can link to an email address used for appointment reminders, which then ties to social-media accounts or children’s gaming profiles. These identity chains make doxxing and harassment far easier.

Credential leaks from one service often cascade. If the same password was used for your dental portal login and your child’s Roblox or Fortnite account, the exposure of one can lead to takeover of the other. Public reporting on similar incidents shows that gaming accounts belonging to children are regularly hijacked once a family’s real-world details surface in ransomware dumps.

Safepay Group’s Known Track Record

Public reporting attributes the safepay ransomware operation to a group that emerged in 2024. The actors have targeted hospitals, schools, and small medical practices across the United States and Europe. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before deploying encryption. They then demand payment and, if unpaid, publish samples or full datasets on their leak site to pressure victims. Notable prior victims include other healthcare providers where patient data was used as leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of data brokers.
• Rotate any password you ever used on artcitydental.com or related patient portals anywhere else it appears, and switch to 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same home address or parent email.
• Let remediation specialists handle takedown requests for any exposed information while you focus on securing accounts and talking with your family about safe online habits.

The incident at Art City Dental is a reminder that ransomware groups continue to treat small, trusted local businesses as entry points into ordinary households. Taking concrete steps now can limit how far this claimed breach travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family coverage that includes children’s gaming accounts. Start your DoxxScan trial today to understand exactly what is exposed and begin closing those doors.