Aviacode (GeBBS) Listed by 0mega Ransomware Group

On February 12, 2023, medical coding provider Aviacode (GeBBS) appeared on the leak site operated by the 0mega ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, which provides outsourced medical coding, auditing, and consulting services, has not publicly quantified how many individuals may be affected, and the leak-site posting does not detail the exact volume or specific categories of data taken.

Primary Disclosure Details

The 0mega leak site entry, still accessible via ransomware.live archives, states that Aviacode was listed after the company apparently declined or failed to meet the group's extortion demands. It explicitly describes the incident as a ransomware attack in which internal files were taken. No patient record count is published, nor does the listing itemize every file type. The disclosure indicates that the data remains available for download or further extortion by anyone who visits the portal. Public reporting on similar 0mega postings shows that once a victim is listed, samples or full archives are often released in stages if payment is not received.

Why This Matters for You and Your Family

When a medical coding vendor loses control of internal files, the exposure can reach far beyond the company itself. Aviacode processes sensitive health information, billing records, and provider contracts on behalf of hospitals and clinics. If your doctor's office or hospital uses outsourced coding services, your protected health information may have been inside those files. Medical coding data frequently includes names, dates of birth, Social Security numbers, insurance details, diagnoses, and treatment codes. Even without an exact victim count, the breach represents a high-severity incident for anyone whose records passed through GeBBS systems. Once this information leaves a secure environment, it can be sold quietly on underground forums long after the initial ransomware noise fades.

Doxxing and Identity-Chain Risks

Health-related records are among the most dangerous when leaked because they create permanent links between your real identity and other online activity. A single exposed insurance claim can tie your name and address to an email address or username that appears in earlier breaches. Attackers then chain these data points together, mapping your full digital footprint. This is exactly how credential leaks cascade into account takeovers on personal email, banking portals, or even gaming platforms. Children’s gaming accounts are especially vulnerable because parents often reuse the same passwords or security questions derived from family medical or address history. The result is a widening doxxing chain that can expose your home address, phone number, and family relationships to stalkers, identity thieves, or harassment campaigns.

0mega Ransomware Group's Track Record

Public reporting attributes the 0mega group with emerging in late 2021 as a double-extortion operation. The actors typically gain initial access through phishing, remote desktop protocol brute-force, or exploited vulnerabilities in unpatched VPN appliances. Once inside, they exfiltrate sensitive files before deploying ransomware. Their playbook relies on public shaming: victims who refuse to pay see their data published on the leak site with countdown timers. Notable prior targets have included healthcare providers, manufacturers, and professional services firms. The group does not always publish full datasets immediately, preferring to drip samples and demand escalating ransoms. This pattern matches the Aviacode listing, where internal files were taken and later advertised.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used at Aviacode or GeBBS anywhere it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same breached credentials.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The Aviacode breach is a reminder that your health data can surface in unexpected places long after a vendor is attacked. Staying ahead requires more than one-time checks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk of takeover. Start your DoxxScan trial today to close the gaps this incident created.