MSSNY Listed by snatch Ransomware Group

On May 22, 2023, the Medical Society of the State of New York (MSSNY) appeared on the leak site operated by the snatch Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack on the organization, which represents approximately 30,000 licensed physicians, medical residents, and medical students across New York State. The disclosure does not quantify the number of affected records or specify the exact data types contained in the stolen files.

Details from the Leak Site

The primary disclosure on the snatch leak site states that MSSNY suffered a ransomware incident in which attackers successfully exfiltrated internal files before encryption or during the compromise. The listing does not detail what specific categories of information were taken, nor does it provide sample data or a victim count. Public views of the onion site at the time showed the organization listed with a reference identifier, but no further technical indicators such as sample documents were openly published in the initial disclosure. The incident aligns with snatch’s standard tactic of using data exfiltration as leverage for extortion payments.

Why This Matters for You and Your Family

If you or any member of your family sees a physician in New York, your medical records, billing details, or correspondence may sit inside the files now held by the attackers. Even though the disclosure does not list exact data types, internal files from a medical society frequently contain names, addresses, dates of birth, Social Security numbers, licensure information, and insurance identifiers. Exposure of this information increases the chance that identity thieves can file fraudulent tax returns, open accounts in your name, or target you with convincing phishing emails that reference your actual doctor or recent medical visit. For households with children who are medical students or residents, the risk extends to early-career identities that are still being built and are therefore easier to hijack.

Doxxing and Identity-Chain Risks

Medical-society data creates long identity chains. A single leaked email address or phone number tied to a physician can be correlated with state licensing boards, hospital affiliations, and family addresses. Attackers then move from that foothold to gaming accounts, social-media handles, and school records belonging to spouses or children. Credential leaks of this kind routinely cascade into account takeovers because professionals often reuse passwords between work systems and personal services. Once one account falls, the attacker can pivot to dox family members by linking the shared home address, children’s names, and associated online profiles.

Snatch Ransomware Group Track Record

Public reporting attributes the emergence of snatch to mid-2022. The group has since listed dozens of organizations across healthcare, education, and professional associations. Their typical playbook begins with initial access gained through compromised credentials or vulnerable remote desktop services, followed by lateral movement inside the network to locate and exfiltrate documents before deploying ransomware. Snatch operators then post victim names on their leak site and, in many cases, threaten to release or sell the stolen data if payment is not received. The group does not always publish large volumes of sample data immediately, preferring to keep pressure on the victim through private negotiation while maintaining the public listing as proof of compromise.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you used at MSSNY or related medical-affiliation portals anywhere else it appears, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address and identity details.
• Let remediation specialists perform hands-on takedown requests for any exposed personal records appearing on data-broker or extortion sites.

The incident underscores that even professional associations holding physician data remain targets, and the fallout can reach every member of your household. Start your DoxxScan trial today to gain continuous monitoring, AI-powered identity-chain mapping, and direct specialist support that keeps your family’s digital footprint under control. DoxxScan is also effective for protecting gaming accounts because credential leaks like this one frequently cascade into account takeovers and doxxing chains.