Healthcare Retroactive Audits Listed by dragonforce Ransomware Group

On November 26, 2025, the dragonforce ransomware group listed 22,171,128 medical record files from Healthcare Retroactive Audits, packaged into 11 archives after a ransomware attack on the firm that performs retroactive audits for insurers and hospitals.

What's Publicly Reported from Reporting

Public reporting on the dragonforce leak site indicates the files were exfiltrated during a ransomware incident. Healthcare Retroactive Audits took no apparent steps to prevent publication of the data. When contacted, the NIH Information Security Program reportedly showed no interest in resolving the matter. The group has stated these files represent only a portion of the total breach and is still deciding whether to release more. The exposed internal files contain sensitive medical records belonging to patients whose data passed through the auditing process.

22,171,128 medical record files were packaged and listed for potential download or extortion. No exact number of individual patients has been confirmed, but the volume suggests hundreds of thousands or more people are affected.

Why This Matters for You and Your Family

Medical records are among the most sensitive types of personal data. Once exposed, they can be used to commit identity theft, file fraudulent insurance claims, or target family members with scams that reference real diagnoses or treatments. If you or anyone in your household has received care from hospitals or insurers whose records were audited by this firm, your information may now be in criminal hands. The breach affects ordinary patients, not just large institutions. Your family’s health history, addresses, dates of birth, and policy details could be circulating on dark web forums within days.

Credential leaks often accompany these incidents. When login details or email addresses appear alongside medical data, attackers can chain them to access online patient portals, banking accounts, or email. Children’s records are sometimes included in family policies, exposing minors to long-term risks.

The Doxxing and Identity-Chain Implications

Medical data rarely travels alone. A single leaked email or phone number can link gaming accounts, social media handles, and family addresses. Attackers use these connections to build full identity profiles for doxxing, harassment, or targeted phishing. Gaming accounts belonging to your children are especially vulnerable because kids often reuse passwords or email addresses tied to family medical insurance records. One breach can cascade into account takeovers across platforms, turning private health information into public exposure.

Identity-chain mapping becomes critical here. What starts as a hospital audit file can quickly reveal your home address, children’s names, and online personas if the links are not broken early.

Dragonforce Group Track Record

Public reporting attributes the attack to the dragonforce ransomware group. The group emerged in recent years and has targeted organizations across multiple sectors with a playbook that typically involves initial access through phishing or exploited vulnerabilities, followed by data exfiltration and deployment of ransomware. They then list stolen archives on leak sites and demand payment to prevent full publication. Notable prior victims include various corporations whose internal files were published after negotiations failed. Their extortion style combines data leaks with threats of broader release, often giving short deadlines before dumping additional portions of the stolen material.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can break the chains before they are exploited.
• Rotate any password you used at Healthcare Retroactive Audits or related hospital or insurer portals, and enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential-stuffing attacks from this claimed breach.
• Let remediation specialists handle takedown requests for any data brokers or sites already publishing pieces of your information.

The incident shows how quickly a single vendor breach can expose your family’s most private health details to criminals who specialize in chaining data for profit. Taking deliberate steps now can limit the damage and reduce the chance that this leak becomes the first link in a larger identity compromise. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts.