Avamere Family of Companies Listed by Avoslocker Ransomware Group

On December 26, 2022, healthcare provider Avamere Family of Companies appeared on the leak site of the AvosLocker ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, founded in 1995 and headquartered in Wilsonville, Oregon, operates multiple healthcare organizations and systems. Anyone whose medical records, employment documents, or personal information passed through Avamere may now face heightened risk of identity theft and doxxing.

Details from the Leak Site

The primary disclosure on the AvosLocker leak site states that internal files were exfiltrated from Avamere Family of Companies. The listing does not quantify how many records were taken, name the specific systems compromised, or list exact data types beyond the broad description of internal files. No ransom demand figure or payment deadline is publicly detailed on the page. The incident is presented as a completed ransomware deployment followed by data exfiltration, consistent with the group’s standard extortion method of threatening to publish stolen information if payment is not received.

Why This Matters for You and Your Family

If you or a family member received care at an Avamere facility, worked there, or had insurance claims processed through the organization, your personal information may be among the stolen files. Healthcare data often includes names, addresses, dates of birth, Social Security numbers, medical histories, and insurance details. Once exposed, this information fuels identity theft, insurance fraud, and targeted phishing. Healthcare breaches remain especially damaging because the data retains value to criminals for years. Families cannot assume the breach only affects “corporate” records; patient files and employee documents frequently contain information about spouses, children, and dependents.

Doxxing and Identity-Chain Risks

Stolen internal files can serve as the foundation for doxxing chains. Criminals combine leaked healthcare data with information from other breaches to link email addresses, phone numbers, usernames, and physical addresses to real people. This mapping allows attackers to target family members across social media, gaming platforms, and financial accounts. A single exposed medical record can lead to spear-phishing campaigns that trick relatives into revealing additional credentials. Children’s gaming accounts are particularly vulnerable because parents often reuse passwords or security questions derived from personal details found in healthcare files.

AvosLocker’s Known Track Record

Public reporting attributes the emergence of AvosLocker to mid-2021. The group has targeted organizations across multiple sectors, including manufacturing, education, and healthcare. Its typical playbook involves gaining initial access through phishing or exploited remote desktop protocols, deploying ransomware to encrypt systems, and exfiltrating data before triggering the encryption. After encryption, AvosLocker operators contact victims and threaten to publish the stolen files on their leak site if ransom is not paid. The group has shown willingness to follow through on publication when demands are ignored, though the volume and sensitivity of data released varies by victim.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Avamere breach.
• Rotate any password you used at Avamere or related healthcare portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and acted on quickly.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks cascade from healthcare data.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise require months of manual effort.

The Avamere listing is a reminder that healthcare organizations remain high-value targets and that individuals must treat every breach as a potential link in a larger identity compromise chain. Start your DoxxScan trial today for hands-on remediation by specialists and continuous monitoring that keeps your family ahead of the next leak. GalaxyWarden’s DoxxScan combines continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists with household coverage that includes children’s gaming accounts.