LivingHope Vision Clinic in Burlington and Hamilton, Ontario, appeared on the LockBit3 ransomware leak site on August 30, 2023. The listing states that internal files were exfiltrated during a ransomware attack. The clinic has not published a public breach notification detailing the number of patients or employees affected, nor has it specified exactly which categories of records were taken.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
Primary Disclosure Details
The LockBit3 leak site entry states that LivingHope Vision Clinic was hit by a ransomware operation and that attackers successfully removed internal files before encryption. The posting does not quantify the volume of data, list specific record types such as patient names, medical histories, insurance details, or employee payroll information, and does not disclose any ransom demand. As is typical with these listings, the group gave the clinic a short deadline to negotiate before promising to publish samples or the full archive. No independent regulator filing or company statement has yet clarified the scope, leaving the exact scale of exposure unknown at this time.
Why This Matters for You and Your Family
If you or any member of your family has visited LivingHope Vision Clinic for eye exams, prescriptions, or other vision services, your personal and health-related information may now sit in an attacker-controlled archive. Health data carries long-term risk because it cannot be changed like a password; once exposed it can be used for insurance fraud, identity theft, or targeted phishing that references real medical details. Even without an exact patient count, the fact that internal files were taken means anyone whose records were stored on the clinic’s systems should treat this incident as a high-severity exposure.
Doxxing and Identity-Chain Risks
Ransomware groups rarely stop at the first system they breach. Internal files often contain spreadsheets that link patient names, addresses, phone numbers, email addresses, and sometimes dates of birth or Social Insurance Numbers. These details become the foundation for doxxing chains that connect your healthcare records to social-media handles, family members’ accounts, and even children’s gaming profiles. Once attackers or subsequent buyers map those relationships, they can launch convincing spear-phishing campaigns or sell the bundle on underground forums. Credential leaks of this nature frequently cascade into account takeovers across unrelated services that reuse the same email and password combination.