McKenzie Health System Listed by avoslocker Ransomware Group

On December 26, 2022, McKenzie Health System appeared on the leak site operated by the AvosLocker ransomware group. The Michigan-based not-for-profit hospital and its network of nine regional clinics had fallen victim to a ransomware attack in which internal files were allegedly exfiltrated. The listing does not specify the number of records affected or the exact deadline for any ransom payment.

Details from the Leak-Site Listing

The primary disclosure on the AvosLocker leak site states that McKenzie Health System suffered a ransomware incident and that attackers successfully removed internal files. No sample data was published at the time of the initial listing, and the exact volume or categories of information taken remain undisclosed by both the threat actors and the victim organization. The hospital, which provides medical and surgical services in Sandusky, Michigan, has not released a detailed public breach notification quantifying impacted patient or employee records.

Internal files exfiltrated is the only description provided. This phrasing is typical of ransomware groups that use partial leaks to pressure victims into payment while withholding the full archive from open view.

Why This Matters for You and Your Family

When a regional healthcare provider is hit, the people most directly exposed are local patients, their spouses, children listed as emergency contacts, and current or former employees. Even without an exact record count, the breach places sensitive personal information at risk. Medical histories, insurance details, Social Security numbers used for billing, and home addresses tied to patient accounts can surface in follow-on criminal activity.

Your family’s exposure is not abstract. A single leaked address, phone number, or email connected to a McKenzie Health System record can serve as the starting point for identity theft, fraudulent loan applications, or phishing campaigns that feel personal because they reference real medical events.

The Doxxing and Identity-Chain Risk

Healthcare breaches rarely stop at the initial data set. Threat actors and downstream buyers routinely combine stolen medical files with credential leaks from other services to build detailed identity profiles. A password reused between a patient portal and a retail account, or a phone number tied to both a clinic record and a child’s gaming username, creates a chain that can lead to account takeovers and public doxxing.

Credential leaks like this one cascade into account takeovers and doxxing chains, especially when children’s gaming accounts are linked to the same household email or phone number used at the hospital. Once an attacker maps one piece of information to a real person, the rest of the household becomes easier to target.

AvosLocker’s Known Track Record

Public reporting attributes AvosLocker’s first significant activity to mid-2021. The group has targeted organizations across healthcare, manufacturing, and local government sectors. Its typical playbook involves gaining initial access through phishing or exploited remote desktop protocols, followed by exfiltration of sensitive files before deploying ransomware. After encryption, AvosLocker operators publish victim names on their leak site and offer to negotiate decryption keys or deletion of the stolen data for payment, often in cryptocurrency.

The group has shown willingness to extend deadlines or release small proof-of-compromise samples when victims ignore initial contact. While not every listed organization ultimately suffers full data publication, the threat of gradual or complete leaks remains real.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any connections to McKenzie Health System records.
• Rotate passwords used at the hospital’s patient portal or employee systems anywhere they are reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure tied to your household is caught and addressed in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing day-to-day accounts.

The speed with which ransomware groups move from initial access to public shaming continues to shrink. Taking deliberate steps now limits how far this particular incident can reach into your life or your family’s digital footprint. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage provide a practical way to reduce that exposure for you and those who share your last name or address.