On October 9, 2025, the Health & Vitality Center in Los Angeles had its internal files listed for sale on the Safepay ransomware group’s leak site after the attackers exfiltrated data from the holistic medical practice at 11600 Wilshire Blvd, Suite 120.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
What Public Reporting Shows
Public reporting indicates the breach stems from a ransomware incident in which Safepay gained access to the clinic’s systems, copied internal documents, and later published a post on its dark-web leak site. The exact number of patients or staff affected remains unknown because the sample files shown contain a mix of business records whose full scope has not been disclosed. Available reporting describes the exposed material as internal files rather than a structured database of patient names, though medical practices of this type routinely hold names, dates of birth, contact details, insurance information, and treatment notes. No evidence has surfaced that payment card data or Social Security numbers were the primary target, yet any exfiltrated documents could still contain such details in unstructured form.
Why This Matters for You and Your Family
When a local medical provider is hit, the information stolen is rarely limited to billing codes. It often includes the personal details you gave them so they could treat you or your children. Once those records leave the clinic’s control, they can appear on multiple underground markets within weeks. Credential leaks from one health provider frequently cascade into email, patient-portal, and even gaming-account takeovers because people reuse passwords. If your family has ever visited a holistic or integrative clinic, this incident is a concrete reminder that your data may already be in circulation even if you never received a breach notice.
The Doxxing and Identity-Chain Implications
Medical files are high-value connectors in doxxing campaigns. An attacker who obtains your name, address, and date of birth from a clinic record can cross-reference it with handles found on social media or gaming platforms. This creates an identity chain that links your real-world identity to online personas you thought were separate. The result is accelerated doxxing: exposure of home addresses, phone numbers, and family relationships that can lead to harassment, identity theft, or targeted scams. Credential leaks like this one are especially dangerous for gaming accounts belonging to you or your children, because those accounts often share the same email address or password patterns used for medical portals.