Foursquare Healthcare Listed by RansomHouse Ransomware Group

On September 27, 2023, Foursquare Healthcare appeared on the RansomHouse ransomware leak site, claiming the group had exfiltrated internal files during a ransomware attack on the long-term care and rehabilitation provider.

Details from the Leak Site

The RansomHouse listing states that internal files were taken from Foursquare Healthcare following a ransomware deployment. The disclosure does not quantify how many patient or employee records were affected, nor does it list specific data types such as names, Social Security numbers, medical histories, or financial details. The sample data shown on the onion site is limited, and the full volume or exact contents remain undisclosed by both the threat actor and the victim. Foursquare Healthcare’s own description emphasizes compassionate, personalized care across its supported facilities, yet the company has not issued a public breach notification that details the timeline or scope as of the listing date.

RansomHouse gave the organization a short window to negotiate before publishing additional material, a standard pressure tactic for this group. The leak site entry itself serves as the primary public disclosure.

Why This Matters for You and Your Family

If you or a family member received care at a Foursquare Healthcare facility, your personal health information may now sit in an attacker’s archive. Healthcare records contain permanent identifiers—dates of birth, addresses, insurance details, and clinical notes—that cannot be changed like a password. Exposure of such data raises the risk of insurance fraud, prescription abuse, and long-term identity theft that can follow families for years. Even when exact record counts are unknown, the targeting of a care provider means the information is highly sensitive and valuable on underground markets.

Doxxing and Identity-Chain Risks

Stolen internal files often include employee directories, vendor contracts, and patient contact lists that link names to emails, phone numbers, and physical addresses. These details fuel doxxing chains: once attackers tie an email to a username on one platform, they can pivot to gaming accounts, social media, and family connections. Credential leaks of this nature frequently cascade into account takeovers, especially for gaming profiles belonging to children or teenagers who reuse passwords. The real-world outcome is not abstract; it can mean harassment, SIM-swapping attempts, or targeted phishing against every household member whose data appears in the same address book.

RansomHouse Track Record

Public reporting attributes RansomHouse’s emergence to late 2021. The group has since listed hundreds of organizations across healthcare, manufacturing, and professional services. Notable prior victims include multiple U.S. healthcare providers and mid-sized enterprises whose data appeared on the same leak site. Their typical playbook involves initial access through compromised credentials or vulnerable remote desktop services, followed by claimed exfiltration of sensitive files before encryption. RansomHouse then demands payment to prevent publication, using a double-extortion model that combines data leak threats with operational disruption. The group’s leak site remains active and continues to publish new victims on a regular basis.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Rotate any password you used at Foursquare Healthcare or related provider portals anywhere it has been reused, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential-based takeovers.
• Let remediation specialists handle takedown requests for any personal information already circulating on data broker sites tied to this incident.

The incident underscores that healthcare providers remain prime targets and that a single listing can place your family’s most sensitive details at risk for years. Start your DoxxScan trial today for continuous monitoring, AI-powered identity-chain mapping, and hands-on help from specialists who manage these threats for the entire household, including gaming accounts.