Garn Mason Orthodontics was hacked. All insurance and personal data of customers was stole Listed by knight Ransomware Group

On September 29, 2023, the ransomware group known as Knight Ransomware added Garn Mason Orthodontics to its public leak site, stating that the orthodontic practice had been hacked and that all insurance and personal data of customers was stolen.

Details from the Leak-Site Listing

The primary disclosure appears on the Knight ransomware leak site, hosted on the dark web and indexed by ransomware.live. The listing claims that internal files were exfiltrated during a ransomware attack but does not quantify the number of affected patients or list specific record counts. It states that the data includes insurance information and other personal details belonging to the practice’s customers. The disclosure does not provide samples of the stolen material, nor does it specify which systems were initially compromised. As is typical with these listings, the group sets an implicit deadline for payment before threatening full publication, although the exact ransom demand and remaining time window are not detailed in the public entry.

Why This Matters for You and Your Family

When an orthodontics provider loses control of patient records, the people affected are ordinary families who brought their children in for braces, retainers, or routine care. Insurance details and personal data can include names, dates of birth, Social Security numbers, addresses, policy numbers, and billing records. Once stolen, this information rarely stays contained. It can surface in identity-theft schemes, fraudulent insurance claims, or be packaged and sold on underground forums. Because many families reuse the same contact details across medical, school, and financial accounts, a single breach like this creates overlapping exposure that is difficult to track without deliberate effort.

The Doxxing and Identity-Chain Risk

Medical and dental records frequently serve as the starting point for larger doxxing chains. A phone number or email tied to a child’s orthodontic account can be correlated with gaming usernames, school portals, or family social-media profiles. Attackers then use these links to impersonate family members, reset passwords on linked services, or harass victims directly. Credential leaks of this nature often cascade into account takeovers precisely because healthcare providers are trusted holders of multiple pieces of identifying information. Children’s records are especially attractive targets: a minor’s data combined with a parent’s insurance policy can open doors to synthetic identity fraud that may go undetected for years.

Knight Ransomware Group’s Known Track Record

Public reporting attributes the Knight Ransomware Group’s first notable activity to late 2022. The group has since targeted healthcare providers, professional service firms, and small-to-medium businesses across the United States and Europe. Its typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files before encryption. Knight then posts victim names on its leak site and offers to negotiate via a Tor-based chat portal. If payment is not received, the group releases additional proof files or sells the data to third parties. While not the largest ransomware operation, Knight maintains a consistent pace of weekly listings, focusing on organizations it believes will pay to avoid reputational damage or regulatory scrutiny.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any data tied to Garn Mason Orthodontics.
• Rotate passwords used at the orthodontic practice or any healthcare provider where the same credentials appear, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts which often chain back to the same contact details.
• Let remediation specialists handle takedown requests for any exposed personal records that appear for sale or on public forums.

The incident at Garn Mason Orthodontics illustrates how quickly healthcare data can move from a trusted provider to a public extortion listing. Acting promptly on the credentials and contact details you used with the practice can limit how far attackers travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to gain visibility and control over what has already leaked and what may surface next.