Dr. Leeman ENT Listed by BianLian Ransomware Group

On March 18, 2024, Dr. Leeman ENT, an Austin-based ear, nose, and throat practice offering both medical procedures and cosmetic surgery, was listed on the leak site of the bianlian ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The practice, which has served the Austin area since 2000, has not publicly quantified the number of patients or staff whose information may have been taken, nor has it detailed the exact contents of the files.

Primary Disclosure Details

The bianlian leak site is the primary source, accessible via the onion address published through ransomware.live. It claims successful data exfiltration from Dr. Leeman ENT’s systems but does not specify the volume of records, the precise data types beyond “internal files,” or any patient names, dates of birth, Social Security numbers, or financial details. The clinic’s own description confirms it handles sensitive medical and cosmetic patient records, which aligns with the high-severity classification of the incident. No ransom demand figure or payment deadline appears in the public listing.

Why This Matters for You and Your Family

If you or a family member has been a patient at Dr. Leeman ENT since 2000, your protected health information may now sit in an attacker’s archive. Medical records often contain names, addresses, phone numbers, dates of birth, insurance details, and clinical notes that remain valuable for years. A single exposure like this can fuel identity theft, insurance fraud, or phishing campaigns tailored with credible medical pretexts. Because the breach notification does not quantify affected records, every current or former patient must assume their information is at risk until proven otherwise.

Doxxing and Identity-Chain Risks

Medical practices frequently store not only clinical data but also email addresses, phone numbers, and sometimes driver’s license or Social Security numbers for billing and insurance. These pieces form the foundation of doxxing chains: an attacker who obtains your email and phone from the Dr. Leeman ENT files can cross-reference them with credential-stuffing dumps, public records, and social-media handles. The result is a linked profile that can expose your home address, family relationships, and even children’s names. Credential leaks of this nature routinely cascade into account takeovers on patient portals, email, and other services that reuse the same passwords.

Bianlian’s Known Track Record

Public reporting attributes Bianlian’s emergence to mid-2022. The group has targeted healthcare providers, municipalities, and small-to-medium businesses across the United States and Europe. Its typical playbook begins with initial access gained through phishing, remote-desktop protocol brute-force, or exploited vulnerabilities, followed by claimed exfiltration of internal files before encryption. Bianlian then posts a sample of stolen data on its leak site and pressures victims with threats of full publication or sale to third parties. The group does not always encrypt systems, relying instead on the embarrassment and regulatory consequences of data exposure to extract payment.

What to do

• Rotate any password you have used at Dr. Leeman ENT or on related patient portals anywhere it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address and email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The incident underscores that even specialized medical practices remain attractive targets whose internal files can fuel long-term identity abuse. One short forward-looking step is to treat every healthcare provider as a potential leak source and maintain active oversight of your digital footprint. DoxxScan by GalaxyWarden delivers that oversight through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers.