Healthcare & More Listed by dragonforce Ransomware Group

On November 22, 2025, Healthcare & Moore, an independent insurance brokerage specializing in Medicare, health, life, and dental policies, appeared on the leak site of the dragonforce ransomware group. The company, led by Myra “Lynn” Moore, is claimed to have had internal files exfiltrated after a ransomware attack. While the exact number of affected individuals remains unknown, clients who shared personal information for insurance quotes or policy management are potentially exposed.

What Public Reporting Shows

Available reporting describes the incident as a ransomware attack in which internal files were allegedly exfiltrated. The data was later published on the dragonforce leak site. Healthcare & Moore provides insurance products from more than 300 organizations and serves a client base that includes many seniors seeking Medicare and related coverage. Public reporting indicates the breach involves documents that could contain names, addresses, dates of birth, Social Security numbers, and health-insurance details. No official statement from the company had been widely reported at the time of initial publication on the leak site.

Why This Matters for You and Your Family

When an insurance broker’s files are stolen, the information inside often includes the exact details criminals need to open accounts, file fraudulent tax returns, or impersonate you with health providers. Seniors and their adult children are frequently targeted because Medicare records can be used to order expensive equipment or prescription drugs billed to government programs. If your family has ever used an independent broker for health, life, or supplemental insurance, this claimed breach could place your household in the crosshairs. The exposure of even one family member’s data can quickly affect everyone sharing the same address or phone number.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at publishing one set of files. Once personal records appear on a leak site, they are scraped by automated scanners and resold on multiple forums. A single email or phone number can link gaming accounts, social-media handles, and family-member profiles into a complete identity chain. Credential leaks like this one routinely cascade into account takeovers on Steam, Roblox, or other platforms used by children. Public reporting indicates that such chains allow attackers to harass victims, demand payment, or sell the full dossier to the highest bidder. The longer the data circulates unchecked, the harder it becomes to contain.

Dragonforce Group’s Publicly Known Track Record

Public reporting attributes the attack to the dragonforce ransomware group. The group emerged in recent years and has listed healthcare providers, insurers, and other businesses on its leak site. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration and deployment of ransomware. After encryption, the group threatens to publish stolen files unless a ransom is paid. When victims do not pay, dragonforce posts samples and eventually releases larger batches of data on its onion-site portal. Exact details of its earlier victims remain limited in open sources, but the pattern of targeting small-to-medium businesses that hold sensitive personal information is consistent.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what this claimed breach connects to.
• Rotate the password used at Healthcare & Moore anywhere it is reused and switch on 2FA using an authenticator app, not text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The incident shows how quickly insurance-client data can fuel larger identity crimes and doxxing campaigns. Taking concrete steps now limits the damage and reduces the chance that your family becomes the next target. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.