azliver.com Listed by lockbit3 Ransomware Group

On January 29, 2023, the ransomware group LockBit3 added azliver.com to its public leak site, claiming that the Arizona Liver Health medical practice had been hit by a ransomware attack and that internal files had been exfiltrated. The listing does not specify how many patients or staff are affected, nor does it detail the exact volume or types of records taken beyond stating that internal files were stolen.

Reported Details from the Listing

The primary disclosure on the LockBit3 leak site states that Arizona Liver Health suffered a ransomware intrusion and that attackers successfully exfiltrated internal files before encrypting systems. No patient count, no list of specific data fields, and no ransom amount appear in the posting. The disclosure indicates the data is now available for download by anyone who visits the leak site, a standard LockBit3 tactic designed to pressure victims into payment. Public reporting on LockBit3 confirms this pattern of publishing proof-of-exfiltration samples and threatening full data release if demands are ignored.

Why This Matters for You and Your Family

If you or any member of your family has ever been treated at Arizona Liver Health, your personal health information may now sit in an attacker-controlled archive. Medical records contain names, dates of birth, Social Security numbers, addresses, insurance details, and clinical notes that together create a high-value identity package. Exposure of liver-disease treatment data carries extra sensitivity because it can reveal chronic conditions, medication histories, and other intimate health facts that identity thieves or blackmailers can exploit for years. Even though the exact number of affected records remains unknown, the mere presence of the organization on a ransomware leak site means you should treat your information as compromised.

Doxxing and Identity-Chain Risks

Health-care breaches like this one frequently cascade into doxxing chains. Attackers or buyers of the data can link your medical record to email addresses, phone numbers, and usernames found in other breaches, then locate your social-media profiles, family members, and even children’s gaming accounts. A single reused password or exposed email can let criminals hijack your online life, file fraudulent tax returns, open accounts in your name, or harass you with targeted phishing that references your private medical history. Credential leaks from medical providers have repeatedly fueled account takeovers across unrelated services, turning one breach into a long-term identity nightmare for entire households.

LockBit3’s Known Track Record

Public reporting attributes LockBit3 as the successor to the original LockBit operation that emerged in 2019 and rebranded after law-enforcement pressure. The group has hit hospitals, clinics, and physician practices worldwide, typically gaining initial access through compromised remote-desktop credentials or phishing. Once inside, they exfiltrate data before deploying ransomware, then use dual-extortion tactics: threatening both encryption and public leak of stolen files. Notable prior victims include numerous healthcare providers where patient records were posted when ransom demands went unpaid. Their playbook relies on speed, automation, and aggressive leak-site pressure rather than prolonged negotiation.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed records.
• Rotate any password you ever used at azliver.com or related patient portals anywhere else it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your accounts.

The Arizona Liver Health incident shows that even specialized medical practices remain prime targets and that patient data can appear on criminal marketplaces without warning. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with this claimed breach. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give you and your family an effective way to stay ahead of the next leak.