dmos.com Listed by lockbit3 Ransomware Group

On March 13, 2023, orthopaedic provider DMOS Orthopaedic Centers appeared on the LockBit 3.0 ransomware leak site. The listing states that internal files totaling 278.69 GB were exfiltrated during a ransomware attack. The exposed material includes scans, purchasing information, marketing information, contracts, insurance documents, and additional unspecified records. The disclosure does not quantify how many patients or employees are affected.

Details from the Leak-Site Listing

The LockBit 3.0 panel entry for dmos.com states that data was stolen and is now published after the organisation apparently declined to pay. The listing explicitly names scans, purchasing information, marketing information, contracts, and insurance documents among the contents. No patient-record count is provided, and the precise number of individuals whose personal or medical information appears in the archive remains unknown. The disclosure indicates the breach stems from a successful ransomware deployment that included exfiltration prior to encryption.

LockBit operators routinely post proof packages and countdown timers on their Tor site; the March 13 entry followed their standard format. Public reporting on LockBit 3.0 shows the group continues to rely on double-extortion tactics: threaten to release stolen data if the ransom is not paid.

Why This Matters for You and Your Family

If you or any member of your family has received care at DMOS Orthopaedic Centers since 1955, your medical scans, insurance details, or contractual records may now sit inside a publicly accessible ransomware archive. Insurance documents often contain Social Security numbers, addresses, dates of birth, and policy numbers — exactly the data needed for identity theft or fraudulent medical claims. Even if your name is not on the front page of the leak, a single matching record can link back to your household.

Medical breaches carry long-term risk because health information rarely expires. A scanned X-ray or surgical consent form can surface years later in fraud schemes or extortion attempts aimed at you or your relatives.

The Doxxing and Identity-Chain Risk

Ransomware leaks like this one rarely stop at the initial publication. Once 278 GB of internal files are loose, other criminals scrape the archive for email addresses, employee names, and vendor contacts. Those details feed credential-stuffing attacks, phishing campaigns, and doxxing chains that connect your work email to personal accounts, social-media handles, and even children’s gaming profiles. A single insurance document can bridge your real identity to an old username, allowing attackers to seize linked accounts and demand payment to stay silent.

DoxxScan by GalaxyWarden continuously monitors 13.1 billion+ breach records across more than 100 platforms and uses AI-powered identity-chain mapping to surface these connections before they are exploited. Its hands-on remediation specialists can also pursue takedowns while household coverage extends protection to every family member, including children’s gaming accounts that frequently become targets once a parent’s data appears in a leak.

LockBit 3.0 Track Record

Public reporting attributes the LockBit 3.0 variant to a ransomware-as-a-service operation that first emerged in early 2020 under the original LockBit name. The group rebranded to LockBit 3.0 in 2022 after law-enforcement pressure and has since hit hospitals, manufacturers, and professional-service firms. Notable prior victims include numerous healthcare providers whose patient data and insurance files were published when ransoms went unpaid. Their typical playbook involves initial access via compromised remote-desktop credentials or phishing, followed by rapid exfiltration using custom tools, then dual extortion: encryption of systems plus public shaming on the leak site with countdown timers. The group openly recruits affiliates and provides them with ready-made ransomware binaries.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what this 278 GB archive may expose about you.
• Rotate any password you ever used at DMOS Orthopaedic Centers or its vendor portals, then enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught and flagged within hours rather than months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same leaked address or parent email.
• Let remediation specialists handle data-broker takedown requests and opt-out processes for you instead of attempting manual removal across dozens of sites.

The incident shows that even established medical providers remain vulnerable to determined ransomware operators who treat patient and insurance data as currency. Acting quickly on the credentials and connections exposed in this leak can limit how far the chain reaches your family. Start your DoxxScan trial today and place continuous monitoring plus specialist remediation between your household and the next extortion campaign.