Cadmet Listed by Royal Ransomware Group

On January 21, 2023, medical equipment dealer Cadmet appeared on the leak site operated by the Royal Ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company has not publicly quantified how many customer or employee records were affected, and the leak-site posting does not detail the specific data types stolen beyond “internal files.”

Primary Disclosure Details

The Royal Ransomware leak portal lists Cadmet as a victim and claims the company’s internal documents were taken after encryption attempts. Cadmet’s own description of its business — a nationwide Sony Medical dealer focused on imaging equipment and patient-facing relationships — appears in the posting, suggesting the attackers scraped corporate information to pressure the company. No ransom amount or payment deadline is shown in the public listing, and the exact volume of data remains unknown. The disclosure indicates the breach occurred through a ransomware deployment that included both encryption and data exfiltration, a standard double-extortion tactic.

Why This Matters for You and Your Family

If you or a family member have ever been a patient at a facility that purchased Sony medical imaging systems, worked with a healthcare provider supplied by Cadmet, or had your contact details stored in a vendor’s customer relationship system, your information may have been exposed. Internal files from a medical dealer frequently contain spreadsheets with buyer names, facility addresses, phone numbers, email accounts, and sometimes patient-contact lists used for service calls. Even without direct medical records, these details can be combined with other leaks to build a profile that puts your household at risk of identity theft, phishing, or targeted scams pretending to be from a trusted healthcare vendor.

Doxxing and Identity-Chain Risks

Medical-vendor data leaks create long identity chains. An email or phone number allegedly taken from Cadmet’s files can be correlated with gaming accounts, social-media handles, or family-member records found in other breaches. Attackers then use these links to hijack accounts, impersonate family members, or launch spear-phishing campaigns. Credential leaks of this kind frequently cascade into gaming-platform takeovers, especially for children’s accounts that reuse an adult’s email address. The real-world outcome is doxxing that exposes home addresses tied to medical facilities, increasing risks of physical stalking or fraud schemes tailored to healthcare relationships.

Royal Ransomware Track Record

Public reporting attributes Royal Ransomware’s first major campaigns to late 2022. The group has since hit hospitals, manufacturers, and service companies across the United States and Europe. Its typical playbook begins with initial access gained through compromised remote-desktop credentials or phishing, followed by lateral movement inside the victim network, exfiltration of sensitive files, and deployment of ransomware that encrypts systems. Royal then posts samples on its leak site and demands payment to prevent full data release. The group has shown willingness to publish healthcare-related vendor data, amplifying pressure on victims who fear regulatory consequences.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed records.
• Rotate any password you ever used at Cadmet or its partner healthcare providers, and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf.

The Cadmet incident shows how vendor breaches in the medical supply chain can quietly expose ordinary families who never directly interacted with the company. A single listing on a ransomware portal can start an identity chain that reaches your home, your children’s online lives, and your financial accounts. Start your DoxxScan trial today and place continuous monitoring, identity-chain mapping, and hands-on specialist remediation between your family and the next leak. Royal’s public activity and similar groups show these incidents will continue; proactive defense is now table stakes for protecting your household.