Gastroenterology & Hepatology of CNY Listed by exitium Ransomware Group

On April 14, 2026, the medical practice Gastroenterology & Hepatology of CNY and its affiliated Digestive Disease Center of CNY appeared on the leak site of the ransomware group Exitium. The attackers posted a sample of internal files and stated they will sell the full database of 167,303 patients unless a ransom is paid. The exposed information includes 124,761 Social Security numbers, addresses for 166,402 patients, phone numbers for 164,296, and email addresses for 85,318.

What's Publicly Reported from Reporting

Public reporting indicates the breach stems from a ransomware attack on the Syracuse, New York-based gastroenterology practice and its AAAHC-accredited endoscopy center. The data set contains 1,093,863 diagnoses coded in ICD-10, 1,547,142 medication records, and 186,246 pathology reports. Both gandhofcny.com and ddcofcny.com domains are listed in connection with the incident. The group gave the practice a deadline to pay or face full publication and sale of the remaining records.

The sample already released confirms the presence of highly sensitive health information alongside standard identifiers. No exact number of affected individuals has been officially confirmed by the practice, but the posted database size points to nearly the entire patient population.

Why This Matters for You and Your Family

If you or any member of your family has ever been treated at Gastroenterology & Hepatology of CNY or the Digestive Disease Center of CNY, your personal health records, Social Security number, home address, phone number, and email may now be in the hands of criminals. Medical data combined with SSNs creates a powerful package for identity theft, insurance fraud, and long-term financial harm. Children listed on family accounts are also at risk because their information often shares the same address and phone numbers.

Health diagnoses and medication histories are especially damaging when leaked. They can be used for blackmail, employment discrimination, or to build convincing phishing messages that reference your actual medical conditions. Ordinary families rarely discover these exposures until loans are denied or surprise medical bills appear under their name.

The Doxxing and Identity-Chain Risk

A single breach like this rarely stays isolated. Attackers routinely cross-reference leaked SSNs, emails, and phone numbers against data from other incidents. This creates an identity chain that can link your medical records to gaming accounts, social-media handles, and family members’ profiles. Once the chain is built, doxxing escalates quickly: home addresses are published, children’s usernames are exposed, and harassers gain enough detail to impersonate you convincingly.

Credential leaks of this type frequently cascade into account takeovers. A password reused from an old patient portal can unlock email, banking, or your child’s Roblox or Fortnite account. The combination of medical detail and personal identifiers makes this incident particularly useful for sophisticated follow-on attacks.

Exitium’s Publicly Known Track Record

Public reporting attributes the attack to the Exitium ransomware group. The group emerged in late 2024 and has targeted healthcare providers, local governments, and small-to-medium businesses. Notable prior victims include other U.S. medical practices and municipal agencies whose patient or citizen data appeared on the same leak site. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of databases and internal files. They then demand ransom and, if unpaid, publish samples and offer the full dataset for sale on their dark-web portal.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and real identity so you can see exactly what this claimed breach connects to.
• Rotate any password you ever used on the patient portal or related GI practice systems, then enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same address and phone numbers leaked here.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your accounts and monitoring credit reports.

The incident shows how quickly medical data can fuel larger identity crimes that affect every member of a household. Taking concrete steps now limits the damage and prevents the breach from becoming the first link in a longer chain of fraud or harassment. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists who also protect family gaming accounts that frequently become targets once personal data surfaces.