eyeDOCS Ottawa Listed by qilin Ransomware Group

On May 5, 2023, eyeDOCS Ottawa appeared on the leak site operated by the qilin ransomware group. The listing states that the Canadian eye care provider suffered a ransomware attack in which internal files were exfiltrated, and that the company “decided not to care about its customers’ data,” prompting the attackers to begin publishing the material. A download link for the first part of the archive was provided along with the password ys5YHSpkbp;sYT5&^%,FPERLHP. The leak-site posting does not specify the number of people affected or list exact data types beyond “internal files.”

Details in the Primary Listing

The qilin leak site entry states that eyeDOCS Ottawa experienced a ransomware intrusion resulting in data exfiltration. It explicitly states the company refused to meet the attackers’ demands, leading to the decision to publish the stolen material in stages. No victim count is given, and the disclosure does not enumerate categories such as patient names, medical records, insurance details, or employee information. The only concrete facts provided are the date of the listing, the ransomware group’s name, and the availability of an initial encrypted archive with the password noted above.

Internal files were allegedly exfiltrated during the ransomware attack, and the group has begun releasing them publicly after negotiations failed.

Why This Matters for You and Your Family

If you or any member of your family has been a patient at eyeDOCS Ottawa, your personal and health-related information may now sit in an archive freely downloadable from a dark-web leak site. Medical and optical records often contain dates of birth, addresses, phone numbers, insurance policy numbers, and sometimes Social Security numbers or driver’s license details. Once these records reach the public domain, they do not disappear. Other criminals routinely scrape ransomware leak sites and feed the data into broader identity-theft operations. The absence of a stated victim count does not mean your information is safe; it simply means the disclosure leaves that question unanswered.

Doxxing and Identity-Chain Risks

Health-care data leaks create long-term doxxing vectors because medical files frequently link multiple identifiers: name, date of birth, address, phone, email, and insurance ID. Attackers can chain these details with credentials stolen from other breaches to take over online accounts, including email, banking, and government portals. Children’s records are especially dangerous because a minor’s data combined with a parent’s creates a household profile that can be exploited for years. Gaming accounts tied to family email addresses or shared phones are often the first point of compromise, allowing attackers to pivot into further personal information. DoxxScan by GalaxyWarden continuously monitors across 13.1B+ breach records and 100+ platforms with AI-powered identity-chain mapping that surfaces these hidden linkages before criminals exploit them.

Qilin’s Known Track Record

Public reporting attributes the emergence of the Qilin ransomware group (also known as Agenda) to mid-2022. The group has targeted organizations across North America, Europe, and Australia, with prior victims including manufacturing firms, professional services companies, and healthcare providers. Their typical playbook begins with initial access gained through compromised credentials or exploited remote desktop services, followed by lateral movement, data exfiltration, and deployment of ransomware. Qilin operators usually wait a short period after encryption before publishing samples on their leak site if ransom is not paid. They favor double-extortion tactics: threatening both operational disruption and public release of sensitive files. The eyeDOCS Ottawa listing follows this established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at eyeDOCS Ottawa or related eye-care portals anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring so the next breach exposing your family is caught in hours, not months, across 13.1B+ records and 100+ platforms.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The eyeDOCS Ottawa breach is a reminder that declining to pay a ransom does not protect patients once data has already left the network. Acting quickly on the personal side can limit how far criminals carry the stolen information. Start your DoxxScan trial today and place continuous identity-chain monitoring and specialist remediation between your family and the growing pile of leaked health-care archives.