Modern Eyez Listed by nokoyawa Ransomware Group

On July 29, 2023, Modern Eyez, a New Mexico-based optometry practice operating since 2003, appeared on the leak site of the nokoyawa ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The practice serves patients in Rio Rancho and surrounding communities with vision examinations and personalized optometric services. Anyone who has visited Modern Eyez for care in the past two decades may have personal information now at risk.

Details from the Leak Site

The primary disclosure on the nokoyawa leak site states that internal files were exfiltrated from Modern Eyez. The listing does not quantify how many patient records were affected, nor does it specify the exact types of data taken. It simply states that the files were obtained in a ransomware incident and gives the company until a set deadline to negotiate before further publication. Public mirrors of the leak site, such as ransomware.live, preserve this original posting with its timestamp of July 29, 2023. No additional detail about stolen data categories, such as names, addresses, Social Security numbers, insurance information, or medical histories, is provided in the listing itself.

Why This Matters for You and Your Family

Patient records from an optometry practice often contain full names, dates of birth, home addresses, phone numbers, email addresses, insurance details, and sometimes Social Security numbers for billing. Even without an exact count, the exposure of such information from a long-established local provider means thousands of families in the Rio Rancho area could be affected. Once this data leaves the clinic’s control, it can be sold, combined with other stolen records, or used to fuel identity theft, fraudulent tax filings, or medical fraud in your name. Your family’s vision-care history is now part of a criminal marketplace that does not respect privacy or deadlines.

Doxxing and Identity-Chain Risks

Medical and optometry breaches frequently serve as the starting point for larger doxxing chains. An attacker who obtains your name, address, and date of birth from Modern Eyez can cross-reference it with credential leaks from other services, gaming platforms, or social-media accounts. This creates a detailed profile that links your real identity to online handles, children’s accounts, and household devices. The result is increased risk of account takeovers, SIM-swapping, or targeted harassment. Credential leaks like this one regularly cascade into gaming-account compromises, especially for families where children reuse email addresses or passwords across services.

Nokoyawa’s Known Track Record

Public reporting attributes the first appearance of nokoyawa to late 2022. The group has since targeted organizations across North America and Europe, focusing on mid-sized businesses and healthcare-adjacent providers. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files before deploying ransomware. Rather than noisy encryption alone, nokoyawa emphasizes quiet data theft and extortion, publishing samples on their onion site when victims do not pay. The group’s leak pages usually list a negotiation window measured in days or weeks, after which additional data dumps appear. This incident follows the pattern seen in their earlier campaigns against other small-to-medium organizations.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you ever used at Modern Eyez anywhere it has been reused, and immediately enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The Modern Eyez breach illustrates how even a single local healthcare provider’s compromise can ripple outward, exposing families to long-term identity and doxxing risks. Staying ahead requires more than reactive checks; it demands ongoing visibility into how your information travels across the internet. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: nokoyawa leak site (via ransomware.live)