mtspokanepediatrics.com Listed by lockbit5 Ransomware Group

On January 2, 2026, the LockBit ransomware group added mtspokanepediatrics.com to its public leak site, claiming that internal files had been exfiltrated from the Spokane, Washington pediatric practice.

What's Publicly Reported from Reporting

Public reporting indicates the medical provider’s systems were compromised in a ransomware incident. The attackers posted proof of access on their dedicated leak site, a Tor-hosted page reachable only through specific onion links. Available details show that internal files were taken, although the exact number of patient records or affected individuals remains unknown at this time. The practice serves families from newborns through young adulthood, meaning any exposed data is likely to include names, dates of birth, medical histories, contact information, and possibly insurance or Social Security numbers for both children and parents.

The listing appeared without an immediate public statement from the clinic, which is common in the early stages of ransomware disclosures. Industry research from sources such as DoxxScan™ continuous monitoring indicates that healthcare organizations remain frequent targets because patient records retain value on underground markets long after the initial breach.

Why This Matters for You and Your Family

When a pediatric clinic’s files are stolen, the impact reaches beyond the doctor’s office and directly into your household. Children’s medical records contain permanent identifiers that cannot be changed like a password. A single leak can follow your family for years, increasing the chance that scammers will target you with convincing medical fraud, insurance scams, or identity theft involving a minor’s name.

Parents often reuse the same email address or password across their child’s patient portal, their own work accounts, and family gaming logins. Once that credential appears on a leak site, it can be tested automatically against dozens of other services. For many families this is the moment a simple data breach turns into persistent harassment or financial loss.

The Doxxing and Identity-Chain Implications

Medical breaches create especially dangerous identity chains. A child’s date of birth and parent’s email can be combined with gaming usernames, school records, or social-media handles to build a complete profile. Attackers then use these links to dox family members, harass them on public platforms, or sell the bundle to others who specialize in SIM-swapping or account takeover.

Credential leaks like this one cascade into gaming account takeovers because children frequently use the same email for Roblox, Fortnite, Minecraft, or Discord that was entered at the doctor’s office. Once an attacker controls a child’s main gaming account, they can pivot to linked family devices, shared payment methods, and ultimately the parent’s identity. This is exactly why continuous monitoring that traces these connections matters.

LockBit’s Publicly Known Track Record

Public reporting attributes the attack to the LockBit ransomware group, which first appeared in 2019 and has since become one of the most prolific ransomware operations. The group has previously listed hospitals, clinics, and other healthcare providers, often following the same pattern: gain initial access through phishing or exploited remote desktop services, exfiltrate data before encryption, then threaten to publish sensitive files unless a ransom is paid.

LockBit typically posts samples on its leak site and sets a deadline for payment, after which it offers the data for sale to the highest bidder. In many past cases the group has also allowed affiliates to operate under its brand, making attribution precise at the brand level but harder at the individual operator level.

What to do

• Run a DoxxScan to map every link between your family’s emails, phones, gaming handles, and real identities so you can see exactly what chains exist right now.
• Rotate the password used at mtspokanepediatrics.com anywhere it is reused and switch to 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same parent email or address.
• Let the remediation specialists handle takedown requests across data brokers and suspicious sites while you focus on securing your own accounts.

The speed with which ransomware groups publish stolen medical data shows that waiting for official notices is no longer enough. Taking concrete steps now can break the chain before it reaches your family. DoxxScan by GalaxyWarden provides that continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts.