Genie Healthcare Listed by Everest Ransomware Group

On December 20, 2024, healthcare provider Genie Healthcare appeared on the leak site of the Everest ransomware group. The listing states that the attackers exfiltrated internal files during a ransomware incident, including what the group describes as the entire history of employee records and personal data. The post claims more than 4,400 personal IDs and a total of 110GB of stolen data, and it urges a company representative to contact the attackers before the deadline expires.

Primary Disclosure Details

The Everest leak site listing, accessible via the ransomware.live mirror at the onion address provided, states that data was taken from Genie Healthcare’s systems in a ransomware attack. It does not specify the exact types of personal information beyond referencing employee records and personal data, nor does it list individual fields such as Social Security numbers or medical details. The disclosure indicates the volume of data taken totals 110GB and includes more than 4,400 personal IDs. No public breach notification from Genie Healthcare had been issued at the time the listing appeared, leaving many specifics unknown to affected individuals.

Why This Matters for You and Your Family

If you or a family member ever worked at or received services from Genie Healthcare, your personal information may now sit in the hands of extortionists. Employee records frequently contain full names, dates of birth, addresses, Social Security numbers, banking details for direct deposit, and health insurance information. When such data reaches a ransomware group’s leak site, the risk is not theoretical. It can be sold quietly on underground forums or used to launch targeted attacks against you or your household. Even if the exact contents remain undisclosed, the scale claimed — more than 4,400 personal IDs — suggests a significant number of current and former employees and possibly their dependents are affected.

Doxxing and Identity-Chain Risks

Stolen employee files rarely exist in isolation. A single record can link your work email, personal phone number, home address, and spouse or children’s names. Attackers and data brokers routinely combine these fragments with information from other breaches to build complete identity profiles. The result is doxxing chains that expose social media accounts, children’s gaming usernames, school records, and financial portals. Credential leaks of this nature often cascade into account takeovers across unrelated services where the same password was reused. Public reporting on similar incidents shows that healthcare employee data is especially prized because it frequently includes direct deposit routing information and tax forms that accelerate identity theft and tax fraud.

Everest Ransomware Group Track Record

Public reporting attributes the Everest ransomware group with emerging in 2021 and maintaining a double-extortion model that combines encryption of victim systems with public threats to publish stolen data. The group has listed dozens of organizations across healthcare, manufacturing, and professional services sectors. Notable prior victims include mid-sized hospitals and healthcare staffing firms, many of which faced pressure through both operational disruption and the threat of employee and patient data exposure. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of documents before deploying ransomware. The group then negotiates via a dedicated leak site, using countdown timers to increase pressure. The Genie Healthcare listing follows this established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used at Genie Healthcare or related systems anywhere it has been reused, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address and parent identity.
• Let the remediation specialists perform hands-on takedown requests across data brokers and extortion platforms on your behalf.

The incident underscores how quickly employee data from a single healthcare provider can fuel broader identity crimes. Acting promptly limits the window during which criminals can exploit the 110GB they claim to hold. Start your DoxxScan trial for continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage that includes children’s gaming accounts. Its household protection helps break the doxxing chains that begin with breaches exactly like this one.