greatlakesmbpm.com Listed by dispossessor Ransomware Group

On July 15, 2023, medical billing provider Great Lakes MBPM appeared on the leak site of the Dispossessor ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company’s practice management systems. The disclosure does not specify the number of affected individuals or the exact volume of data taken.

Details from the Leak Site

The primary disclosure on the Dispossessor leak site states that Great Lakes MBPM, which provides compliant medical billing and practice management services, had files stolen in a ransomware incident. The group published a sample of the allegedly exfiltrated material and set a deadline for public release of the full archive. As is typical with these listings, the exact data types exposed and record counts are not detailed in the posting itself. The notification simply states that internal files were taken, leaving patients, partner practices, and employees to assume their information may be included.

July 15, 2023 marks the first public confirmation of the breach through the ransomware actor’s own channel. No separate regulatory filing or customer notification letter has been referenced in the primary source.

Why This Matters for You and Your Family

When a medical billing company is breached, the information at risk often includes names, dates of birth, Social Security numbers, insurance details, diagnosis codes, and billing records. Even though the leak site does not quantify affected records, anyone whose healthcare provider or insurer routes claims through Great Lakes MBPM could have personal health information now in criminal hands. This creates immediate financial and medical identity risks for you and your family. A single exposed claim document can give thieves enough to file fraudulent tax returns, open new accounts, or impersonate you at other medical offices.

Medical data breaches carry longer-lasting consequences than most retail breaches because health records are rarely changed. An old diagnosis or procedure code can be weaponized years later for insurance fraud or blackmail. Families with children, elderly parents, or ongoing treatments face heightened exposure because their linked records create larger identity profiles for attackers to exploit.

Doxxing and Identity-Chain Implications

Stolen internal files from a billing company frequently contain more than clinical data. They can include employee directories, partner clinic contact lists, email correspondence, and spreadsheets that link patient identities to addresses, phone numbers, and sometimes employer information. These details allow attackers to build doxxing chains that connect your medical history to your home address, children’s schools, and online accounts.

Credential leaks or reused passwords found in the files can cascade into gaming account takeovers, especially for households where children use family email addresses or shared phone numbers for Roblox, Fortnite, or other platforms. Once an attacker controls a child’s gaming account tied to the same identity chain, they gain additional personal photos, chat logs, and location data that further enrich the doxxing profile. The result is a single breach that can expose the entire household across both professional and personal spheres.

Dispossessor’s Known Track Record

Public reporting attributes the emergence of Dispossessor to late 2022. The group has targeted mid-sized businesses across healthcare, manufacturing, and professional services. Their typical playbook begins with initial access gained through phishing or exploited remote desktop credentials, followed by rapid exfiltration of internal shares before encryption. Rather than focusing solely on encryption, Dispossessor emphasizes double-extortion: they threaten both system lockdown and public release of sensitive files unless ransom is paid.

The group’s leak site is used as both a pressure tactic and a public shaming platform. Past victims listed by Dispossessor have faced accelerated publication timelines when negotiations stalled. While exact ransom amounts demanded from Great Lakes MBPM remain unknown, the group’s pattern shows they move quickly from private negotiation to public posting, often within days or weeks of initial compromise.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any connections that may have surfaced from this medical billing breach.
• Rotate passwords used at any healthcare provider or billing service tied to Great Lakes MBPM anywhere those credentials are reused, and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails exposed in incidents like this.
• Let remediation specialists handle takedown requests for any personal information already appearing on data broker sites or extortion platforms connected to the breach.

The speed with which ransomware groups like Dispossessor publish stolen medical files shows that waiting for official notifications is no longer sufficient. Start your DoxxScan trial today and use its continuous monitoring, AI-powered identity-chain mapping, and hands-on remediation by specialists to protect yourself and your family, including gaming accounts that can become entry points for further doxxing. Taking these steps now limits the window attackers have to exploit data from the Great Lakes MBPM incident.