G-plans.com Listed by RansomHub Ransomware Group

On October 16, 2024, the ransomware group RansomHub added G-plans.com to its public leak site, claiming that the nutrition and wellness company suffered a ransomware attack in which internal files were exfiltrated.

Reported Details from the Listing

The RansomHub leak page states that internal files were taken during a ransomware incident and are now available for download by anyone who visits the onion link. The listing does not specify the number of records affected, the exact types of documents stolen, or any ransom amount demanded. It simply marks the entry as published on October 16, 2024, and provides a direct link to the alleged data archive. Because the primary disclosure comes from the threat actor’s own site, independent verification of the file contents is not yet public. The notification does not detail whether customer questionnaires, payment records, or employee information were included.

Why This Matters for You and Your Family

If you have ever used G-plans.com to obtain a personalized metabolic meal plan, your name, contact details, questionnaire responses about diet, health conditions, and fitness goals may now sit in files controlled by criminals. That information is far more sensitive than a simple email address. Health and lifestyle data can be cross-referenced with other leaks to build detailed profiles that enable fraud, targeted phishing, or even blackmail. October 16, 2024 marks the moment this data moved from a private corporate network into the hands of opportunistic threat actors who routinely sell or publish it.

The Doxxing and Identity-Chain Risks

Once health-questionnaire data leaves a company like G-plans.com it rarely stays isolated. Attackers combine it with usernames, phone numbers, or partial addresses found in other breaches to create long identity chains. A single reused password or linked gaming handle can turn a nutrition profile into full account takeover across email, social media, and financial services. Children’s gaming accounts are especially vulnerable because parents often reuse credentials or recovery emails that appear in adult-oriented breaches. The result is persistent doxxing that can follow a household for years.

RansomHub’s Known Track Record

Public reporting attributes RansomHub’s first major campaigns to early 2024. The group has since listed dozens of organizations across healthcare, retail, and professional-services sectors. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by claimed exfiltration of internal documents before encryption. They then publish samples on their leak site and pressure victims with deadlines, often giving seven to fourteen days before releasing the full archive. In many cases the group offers “proof” downloads and negotiates via Tor-based chat. The exact success rate of their extortion attempts remains unclear, but their rapid addition of new victims shows an efficient operation that treats leaked data as both leverage and inventory.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to break those chains.
• Rotate any password you ever used on G-plans.com everywhere else it appears, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and recovery emails.
• Let remediation specialists handle takedown requests for any exposed personal documents or health details that surface on data-broker and underground sites.

The incident underscores how quickly a single health-and-wellness signup can feed a larger identity-compromise chain. Starting proactive steps now limits how far criminals can travel with the G-plans.com files. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts.