CHRISTUS Health Listed by Avoslocker Ransomware Group

On December 26, 2022, CHRISTUS Health appeared on the leak site operated by the AvosLocker ransomware group. The international Catholic, faith-based, not-for-profit health system headquartered in the Dallas area had its internal files listed after a ransomware attack in which data was allegedly exfiltrated. The exact number of people affected remains unknown, and the leak-site listing does not detail the specific volume or types of records involved beyond claiming that internal files were taken.

Details from the Leak Site

The primary disclosure on the AvosLocker leak site, archived via ransomware.live, states that CHRISTUS Health suffered a ransomware incident resulting in the exfiltration of internal files. No specific patient records, employee data volumes, or sample documents are quantified in the listing itself. The disclosure indicates the organization was given a deadline to engage with the threat actors or face public release of the stolen material. Public reporting on AvosLocker shows this follows their standard pattern of double extortion: encrypt systems where possible, steal data beforehand, then pressure victims with both decryption demands and the threat of leaks.

Why This Matters for You and Your Family

If you or your family have received care at any CHRISTUS Health facility, your personal health information or related administrative records may have been exposed. Health system breaches carry lasting consequences because medical details are difficult to change and can be used for insurance fraud, identity theft, or targeted scams. Even when exact record counts are not published, the presence of internal files means correspondence, billing records, or operational data that routinely contain names, addresses, dates of birth, and Social Security numbers could be in attacker hands. For ordinary families this translates into months or years of heightened risk for phishing attempts that reference real medical events.

Doxxing and Identity-Chain Risks

Stolen internal files from a healthcare provider often create long identity chains. An email address or phone number lifted from one record can be cross-referenced with other breaches to link gaming usernames, social-media handles, and family addresses. Attackers then pursue account takeovers across services that share the same credentials. This is precisely why credential leaks like this one cascade into doxxing: once a single point of truth about your identity is confirmed, every subsequent breach becomes more dangerous. Gaming accounts belonging to you or your children are frequent targets because they frequently reuse passwords and are tied to the same household details found in healthcare files.

AvosLocker’s Known Track Record

Public reporting attributes the emergence of AvosLocker to mid-2021. The group has targeted organizations across healthcare, manufacturing, and local government sectors. Notable prior victims include multiple U.S. healthcare providers and critical infrastructure entities. Their typical playbook begins with initial access gained through phishing, remote desktop protocol brute-force, or exploited vulnerabilities, followed by deployment of ransomware, exfiltration of sensitive files, and dual extortion: demanding payment for both decryption keys and deletion of the stolen data. The CHRISTUS Health listing fits this pattern exactly, with the public leak site serving as the final pressure tactic when negotiations fail or go unanswered.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the CHRISTUS Health exposure.
• Rotate any password you used at CHRISTUS Health facilities or patient portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address and medical records.
• Let remediation specialists handle takedown requests and broker removals for you while you focus on securing accounts and watching for medical-identity fraud.

The CHRISTUS Health breach is a reminder that healthcare data rarely stays contained once it leaves the building. One exposure can quietly feed dozens of future attacks unless you actively break the identity chains. Start your DoxxScan trial today for continuous monitoring, AI-powered identity-chain mapping, and hands-on remediation by specialists that covers your entire family, including children’s gaming accounts. Its reach across 13.1 billion+ breach records and more than 100 platforms gives ordinary families the same early-warning advantage once reserved for large organizations.