cna-aiic.ca Listed by dispossessor Ransomware Group

On May 21, 2023, the Canadian Nurses Association at cna-aiic.ca appeared on the leak site of the Dispossessor ransomware group, with the attackers publicly naming five senior executives and posting their work emails, phone numbers, and job titles.

Details in the Listing

The primary disclosure on the Dispossessor leak site states that internal files were exfiltrated during a ransomware attack. It does not quantify how many records were taken, which specific systems were compromised, or the volume of data involved. The listing names Villeneuve Michael J., Chief Executive Officer, Atkins Gary, Manager of Information Technology & Services, Dewar Donna, Chief Operating Officer, Fortier Misty, Director of Credentialing Centre & Nursing Policy, and Saleh Lubna Abo, providing direct contact details for each. A link to the group’s Telegram channel invites further information. The disclosure indicates the data was stolen and is now held for extortion purposes, though no ransom amount or payment deadline is listed on the page itself.

Why This Matters for You and Your Family

When a professional association like the Canadian Nurses Association suffers a breach, the exposure quickly reaches beyond the workplace. Nurses, support staff, and anyone whose licensing, certification, or employment records touch the organization may find their personal information entangled in the stolen files. For ordinary families this can mean sudden spikes in targeted phishing, identity theft attempts, or fraudulent loan applications built from real workplace data. Even if you are not a nurse yourself, a spouse, parent, or child whose details appear in shared administrative files faces the same downstream risk. The internal files exfiltrated almost certainly contain correspondence, spreadsheets, or databases that link names, addresses, and contact information in ways that feel deeply personal once they surface on dark-web marketplaces.

Doxxing and Identity-Chain Risks

Publishing executive names, titles, and direct emails creates an immediate anchor point for doxxing chains. Attackers can correlate these professional identities with personal social-media accounts, family addresses, and children’s names. A single leaked work email often unlocks password-reset flows on consumer services, turning one breach into a cascade of account takeovers. Public reporting on similar incidents shows that credential leaks of this nature frequently migrate to gaming platforms, where children’s accounts become entry points for further harassment or extortion. The combination of professional status and personal contact data makes targeted social-engineering attacks far more convincing and dangerous.

Dispossessor’s Known Track Record

Public reporting attributes the first activity of the Dispossessor ransomware group to late 2022. The actors have focused primarily on organizations in North America and Europe, listing healthcare-adjacent and professional-association targets among their victims. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of internal documents before encryption. Extortion follows a double-pressure model: demands are made to the victim organization while stolen samples are simultaneously posted on their leak site to accelerate payment. The group maintains an active Telegram presence to control the narrative and pressure negotiations. While the exact success rate of their campaigns remains unclear, the public postings demonstrate a consistent willingness to release sensitive executive and operational data when ransoms are not paid.

What to do

• Rotate any password tied to your cna-aiic.ca email or any reused credential from the breached organization, and switch to 2FA using an authenticator app instead of SMS.
• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, taking advantage of cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same leaked addresses or parent credentials.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal records appearing on data-broker or extortion sites.

The incident underscores how quickly a single organizational breach can ripple into lifelong identity risk for ordinary people and their families. Staying ahead requires more than reactive checks; it demands ongoing visibility and expert intervention. DoxxScan by GalaxyWarden delivers exactly that through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks. Start your DoxxScan trial today to close the gaps this claimed breach has opened.