AURIS KONINKLIJKE AURIS GROEP Listed by medusalocker Ransomware Group

On November 15, 2022, Dutch healthcare provider AURIS KONINKLIJKE AURIS GROEP appeared on the leak site operated by the medusalocker ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, although the exact volume and specific types of data remain undisclosed by the actors.

Reported Details from the Listing

The medusalocker leak site entry, still accessible via ransomware.live archives, claims the organization suffered a successful ransomware intrusion in which internal data was stolen. No patient record count is provided, no ransom amount is listed, and no sample files appear to have been published at the time of the initial disclosure. The notification simply confirms that internal files were allegedly exfiltrated and that the victim organization had been listed following an unsuccessful extortion attempt. Public reporting on medusalocker’s operational style indicates that such listings typically follow a period of negotiation during which the group threatens to publish stolen material if payment is not received.

Why This Matters for You and Your Family

When a healthcare organization like Auris is breached, the information at risk often includes personal details that can be used to target you or members of your household. Even without exact figures released, the disclosure indicates that internal files were taken. In healthcare environments this frequently encompasses names, dates of birth, contact information, insurance details, and in some cases treatment records. Any of these can be combined with data from other breaches to build a profile that criminals later exploit for identity theft, fraudulent loan applications, or phishing campaigns aimed at your family. If you or a loved one has received services from Auris or affiliated clinics, your information may now sit in an attacker-controlled archive.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at the initial victim. Once internal files leave the organization’s control they can surface on multiple underground platforms, feeding what threat analysts call an identity chain. An email address found in one leak can be matched to a username on a children’s gaming platform; a phone number can be linked to family social-media accounts. These connections allow attackers to move from simple data sales to targeted doxxing, account takeovers, and even physical intimidation. Credential leaks of this nature frequently cascade into gaming account compromises because the same passwords or recovery email addresses are reused across work, personal, and family entertainment services.

MedusaLocker’s Known Track Record

Public reporting attributes the first significant activity by medusalocker to mid-2021. The group has since listed hundreds of victims across healthcare, education, manufacturing, and local government sectors. Notable prior targets have included hospitals and medical suppliers, where the sensitivity of the data increases pressure to pay. Their typical playbook begins with initial access gained through compromised remote desktop credentials or phishing, followed by exfiltration of internal shares before encryption. Extortion occurs in two stages: first demanding ransom to prevent file encryption, then a second demand to stop publication on their leak site. The group has shown willingness to publish samples when victims ignore deadlines, although the Auris listing does not appear to have included proof files at the time it was first observed.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on in hours rather than months.
• Rotate any password you have used at Auris or affiliated healthcare portals anywhere it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or recovery details.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this or linked incidents.

The incident underscores a persistent reality: healthcare data breaches continue to feed long-term identity risks that only grow more dangerous over time. Starting a DoxxScan trial gives you continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that connects usernames to real identities, and hands-on remediation by specialists who can also protect gaming accounts belonging to you or your children. Source: https://www.ransomware.live/id/QVVSSVMgS09OSU5LTElKS0UgQVVSSVMgR1JPRVBAbWVkdXNhbG9ja2Vy