encom##### Listed by Clop Ransomware Group

On December 24, 2024, the Clop ransomware group added Encompass Health to its leak site, announcing it had obtained internal files from the healthcare provider through a ransomware attack involving the Cleo file-transfer software.

What Public Reporting Shows

Public reporting indicates that Clop claims to possess data belonging to multiple companies that use Cleo software. The group stated it is actively contacting affected organizations and offering them a private chat to discuss the situation. Available reporting describes the incident as involving exfiltration of internal files, though the exact volume and specific types of data remain unconfirmed in public announcements. The listing appeared on Clop’s onion site, which is tracked by ransomware monitoring services such as ransomware.live.

Encompass Health has not yet issued a public confirmation of the breach as of the latest available information. The number of individuals whose records may be affected is listed as unknown.

Why This Matters for You and Your Family

When a large healthcare organization experiences a breach, the information involved often includes personal details that can be used to target you or members of your household. Medical records, insurance information, addresses, and contact details are frequently part of such datasets. Once exposed, this information can appear on dark-web marketplaces within weeks, giving identity thieves a head start.

Credential leaks from vendor software like Cleo frequently cascade into account takeovers across unrelated services. If you or your family members reuse passwords, a single breach can unlock email, banking, or social media accounts. Children’s gaming accounts are particularly vulnerable because they often share the same email addresses or phone numbers used for healthcare portals.

The Doxxing and Identity-Chain Risk

Ransomware groups like Clop do not always publish everything they steal. They may sell or trade portions of the data to specialized doxxing networks that focus on linking scattered personal records. A phone number from one breach, an old address from another, and a username from a gaming site can quickly form a complete profile. This identity-chain process turns isolated leaks into targeted harassment, swatting, or sophisticated identity theft.

Public reporting shows these chains frequently begin with healthcare or payroll data and expand through credential-stuffing attacks on consumer accounts. Gaming platforms are common end points because younger users often rely on the same passwords and recovery emails as their parents’ healthcare logins.

Clop’s Publicly Known Track Record

Clop first gained widespread attention in 2019 and became notorious for exploiting vulnerabilities in file-transfer software. The group is best known for the 2023 MOVEit campaign that impacted millions of individuals at dozens of organizations. Its typical playbook involves initial access through zero-day vulnerabilities in widely used enterprise tools, followed by data exfiltration, encryption of systems, and extortion demands directed at both the victim company and, in some cases, the individuals whose data was allegedly stolen.

Public reporting attributes to Clop a pattern of listing victims on dark-web leak sites when ransom demands are not met, often giving companies a short window to negotiate before data samples are released. The group has repeatedly targeted healthcare and financial organizations that process sensitive personal information.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist right now.
• Rotate the password you used at any Cleo-connected service or healthcare portal anywhere it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain back to the same addresses and recovery details.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing accounts.

The speed with which ransomware data moves from leak sites to underground markets leaves little room for delay. Starting with a clear picture of your current exposure and putting continuous safeguards in place is the most practical defense for you and your family. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.