mdihospital.org Listed by dispossessor Ransomware Group

MDI Hospital in Maine appeared on the Dispossessor ransomware group's leak site on June 03, 2023, with the attackers claiming to have exfiltrated internal files during a ransomware incident. The listing publicly names four senior staff members along with their titles, work email addresses, and in one case a direct phone extension, exposing leadership contact details that can be used for identity theft, phishing, or harassment.

Details from the Leak Site

The Dispossessor leak page states that internal files were exfiltrated from mdihospital.org in a ransomware attack. It does not specify the volume or exact types of data taken beyond that description. The disclosure lists four individuals by name and position: Oliveri Cristina I., Director of Quality; Maksutov Artem, Director of Revenue Cycle; Norris Erica J., Director of Care Management; and Kandutsch Mark A., Dr. MD, HC Fam Phys Practice Med Director. Contact details published include cristina.oliveri@mdihospital.org, artem.maksutov@mdihospital.org with phone (207) 288-5082 ext. 1349, erica.norris@mdihospital.org, and mark.kandutsch@mdihospital.org. The page directs readers to the group's Telegram channel for more information.

June 03, 2023 marks the first public listing of the hospital on the Dispossessor site. The disclosure does not quantify how many patient or employee records may have been involved, nor does it confirm whether patient health information was taken.

Why This Matters for You and Your Family

When a hospital's internal files and leadership contact information surface on a ransomware leak site, anyone whose records passed through that facility faces heightened risk. Your name, address, date of birth, Social Security number, insurance details, or treatment history could be among the stolen data even if the listing does not say so explicitly. Attackers frequently use published executive emails and phone numbers to launch targeted phishing campaigns against the organization or its patients. If you or a family member received care at MDI Hospital, the exposure of these internal contacts increases the chance that follow-on scams will arrive in your inbox or on your phone pretending to be from the hospital.

Doxxing and Identity-Chain Risks

Publishing senior staff names, titles, and direct contact details creates immediate doxxing vectors. These pieces of information link professional identities to personal ones through public records, social media, and data-broker profiles. Once attackers connect an executive's work email to a home address or family member names, the breach can cascade into account takeovers, SIM-swapping attempts, or extortion demands directed at the individuals or their households. Credential leaks of this nature frequently spread to gaming platforms, where children’s accounts become entry points for further harassment or identity theft because the same passwords or recovery emails are reused. The public exposure of even a few hospital leaders can therefore endanger every patient record tied to the same institution.

Dispossessor Group's Known Activity

Public reporting attributes Dispossessor with operating as a ransomware and extortion operation that emerged in early 2023. The group typically gains initial access through phishing or exploitation of remote desktop services, exfiltrates sensitive files before deploying ransomware, then posts samples on its leak site when victims do not pay. Notable prior targets have included healthcare and municipal organizations, consistent with the MDI Hospital listing. Their playbook relies on public shaming and selective data dumps rather than full database releases, though the exact volume taken in any incident is rarely disclosed on their site.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you ever used at mdihospital.org or related hospital portals anywhere else it appears, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on within hours.
• Cover the household with DoxxScan family protection that extends to dependents and children's gaming accounts that often chain back to the same breached credentials and addresses.
• Let remediation specialists handle takedown requests for any exposed personal information appearing on data broker sites or extortion platforms.

The incident shows how quickly hospital leadership details can be turned into tools for broader identity attacks that reach patients and their families. Staying ahead requires more than changing one password; it demands ongoing visibility into how your information travels across the internet. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children's gaming accounts vulnerable to credential-based takeovers. Start your DoxxScan trial today to close the gaps this claimed breach and future ones can exploit.