*****l*****.us Listed by cloak Ransomware Group

On December 19, 2025, the website *****l*****.us appeared on the leak site operated by the cloak ransomware group, which claims to have exfiltrated internal files during a ransomware attack on the organization.

Reported Details from Reports

Public reporting indicates the listing occurred on the group’s official data-leak portal. The actors state they obtained internal documents and are prepared to publish them if their demands are not met. The exact number of people whose information is contained in the files remains unknown, and the specific types of records have not been independently verified by third parties. Available reporting describes the incident as a classic ransomware double-extortion scenario in which data is first encrypted and then threatened with public release.

Industry research from sources such as DoxxScan™ continuous monitoring indicates that healthcare-adjacent and small-to-medium service providers are frequent targets because their internal files often contain names, addresses, dates of birth, Social Security numbers, and medical or billing records.

Why This Matters for You and Your Family

When a company that may hold your personal information suffers a breach, the exposed data can be used to open accounts in your name, file fraudulent tax returns, or sell your details on dark-web marketplaces. For families, a single leak can affect every member whose records are stored together—spouses, children, even elderly relatives. Internal files frequently include scanned documents, spreadsheets of client or patient lists, and email archives that reveal far more than a simple password reset would.

Once that information leaves the company’s control, you cannot retrieve it. The only practical defense is to assume the worst-case scenario and act quickly to limit what criminals can build from it.

The Doxxing and Identity-Chain Risk

Ransomware groups rarely stop at posting generic “sample” files. They often comb through stolen spreadsheets looking for high-value targets whose leaked emails, phone numbers, or usernames can be chained to gaming accounts, social-media profiles, and home addresses. A credential leak from one service frequently cascades into account takeovers elsewhere, especially when the same password has been reused. Gaming accounts belonging to children are particularly attractive because they often link back to a parent’s email or phone number, creating a direct path to household doxxing.

Identity-chain mapping—the process of connecting an email address to a gamer tag, then to a physical address—turns a single breach into a road map for harassment, swatting, or targeted phishing. Families who believe “it’s just internal files” may discover months later that their children’s usernames have been doxxed alongside real-world contact details.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains exist before criminals exploit them.
• Rotate the password used at *****l*****.us anywhere it is reused and enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your family is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing accounts and monitoring for identity theft.

The cloak ransomware group first gained attention in early 2024 and has since listed dozens of organizations, typically following a playbook of initial access through phishing or remote-desktop vulnerabilities, followed by exfiltration of sensitive files and extortion via both encryption and public shaming on their leak site. Public reporting attributes earlier attacks to them against healthcare providers, local governments, and professional-service firms. Their pattern is consistent: publish a small sample, set a deadline measured in days or weeks, then begin incrementally releasing larger batches until payment is received or the victim’s data is fully dumped.

Protecting yourself no longer ends with changing a password. A forward-looking approach requires visibility into how your information travels across the internet and rapid, expert help when new leaks surface. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—exactly the kind of layered defense ordinary families need when credential leaks turn into doxxing chains.