Heartcentre Listed by DragonForce Ransomware Group

On January 16, 2025, the Australian medical practice Heartcentre appeared on the leak site of the dragonforce ransomware group, with internal files reportedly exfiltrated during a ransomware attack on its three locations in Castle Hill, Merrylands West and Rouse Hill.

What Public Reporting Shows

Public reporting indicates the three Heart Centre sites provide professional staff and prompt access to investigations and therapy. Available details confirm that internal files were taken in the attack. The number of patients whose information was contained in those files remains unknown. The dragonforce group posted the material on its leak site, as tracked by ransomware.live at the onion address referenced below.

Why This Matters for You and Your Family

When a local medical provider is hit, the information exposed is deeply personal. Medical records, contact details, dates of birth and addresses can give criminals the raw material they need to open accounts, file false tax returns or impersonate you with banks and government agencies. For families, one parent’s breach can expose children’s records that travel with the same address or phone number. Medical data is especially damaging because it can be used for blackmail or sold quietly on underground forums long after the initial headline fades.

The Doxxing and Identity-Chain Risks

A single medical breach rarely stays isolated. Criminals chain the leaked email addresses, phone numbers and patient IDs to usernames on other services. Once they control one account they can reset others, turning a health-centre breach into full identity takeover. Gaming accounts belonging to you or your children are frequent targets because they often reuse the same passwords or recovery emails. Public reporting shows these credential leaks cascade quickly into doxxing campaigns that publish home addresses, family member names and live locations.

Dragonforce Group Track Record

Public reporting attributes the dragonforce ransomware group with operations that emerged in recent years. The group is known for targeting organisations across multiple countries and then publishing stolen data when victims do not pay. Their typical playbook involves initial access through common vulnerabilities or stolen credentials, followed by claimed exfiltration of internal files and extortion demands backed by the threat of public leaks. Exact prior victim lists and timelines remain subject to ongoing tracking by ransomware researchers.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real identity, using the cleanup offered by GalaxyWarden.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours rather than months.
• Rotate every password used at Heartcentre anywhere it has been reused and switch on two-factor authentication through an authenticator app, not text messages.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts tied to the same contact details.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf.

The incident shows that even neighbourhood medical practices can become gateways to long-term identity abuse. Acting quickly on the credentials already circulating can limit the damage before criminals stitch together a complete profile of your family. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who also protect children’s gaming accounts as part of household coverage.