Drug and Alcohol Treatment Service Listed by Interlock Ransomware Group

On October 6, 2024, Drug and Alcohol Treatment Service (DATS) of Lackawanna County appeared on the leak site of the interlock ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the outpatient treatment center that provides drug and alcohol recovery services to the community.

Details in the Leak-Site Listing

The interlock leak page indicates that attackers gained access to the organization’s systems and removed data before encrypting them. It specifically references the SAGE accounting database, SQL database, personal data of employees, and personal data of patients. The disclosure does not quantify how many individuals are affected, nor does it list exact file counts or sample records. As of this writing the listing remains active on the onion site, and no public statement from DATS has altered or contradicted the core claims published by the threat actor.

Why This Matters for You and Your Family

If you or a family member have ever received treatment at DATS, your personal information may now sit in an attacker-controlled archive. Health-treatment records frequently contain full names, dates of birth, Social Security numbers, addresses, phone numbers, insurance details, and clinical notes. Exposure of this information creates immediate financial and medical-identity risks. Even if the leak-site listing does not detail every record type, the confirmed presence of patient personal data means anyone who has used the center should treat their information as compromised until proven otherwise.

Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at the initial breach. Once patient and employee data leaves the victim’s network, it can be cross-referenced with other leaks to build detailed identity profiles. A phone number tied to a treatment record can link to gaming accounts, social-media handles, and family-member profiles. These chains allow harassers, identity thieves, or extortionists to target not only the patient but also spouses, children, and siblings. Credential leaks of this nature often cascade into account takeovers on unrelated services that reuse the same email or password.

Interlock Ransomware Group Track Record

Public reporting attributes interlock with operations that began gaining visibility in early 2024. The group has listed healthcare providers, local government agencies, and small-to-medium businesses across multiple sectors. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by claimed exfiltration of sensitive databases before deployment of ransomware. Interlock then uses dual-extortion tactics: threatening to publish stolen data while simultaneously demanding payment to restore encrypted systems. The group maintains an active leak site where it posts victim names and proof files, applying steady pressure through countdown timers and incremental data drops.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the DATS breach.
• Rotate any password you ever used at DATS or related healthcare portals and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and acted on in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently become targets when parent data appears in leaks like this one.
• Let DoxxScan remediation specialists manage takedown requests and broker opt-outs on your behalf while you focus on securing accounts and talking with your family about the risks.

The DATS breach is a reminder that healthcare providers of any size remain high-value targets. Protecting yourself requires more than changing a password; it demands visibility into how your information travels across the internet and decisive action when new leaks surface. Start your DoxxScan trial today for continuous monitoring, AI-powered identity-chain mapping, and hands-on help from specialists who can reduce the long-term exposure for you and your entire household, including children’s gaming accounts that often chain back to the same leaked details.