MultiCareInc pt.2 Listed by Everest Ransomware Group

On April 7, 2023, healthcare provider MultiCare appeared in a new listing on the Everest ransomware group’s leak site, labeled “MultiCareInc pt.2.” The group stated it had exfiltrated internal files during a ransomware attack and published a sample of the stolen data as proof.

Details in the Leak-Site Posting

The Everest leak page, still accessible via the onion link tracked by ransomware.live, states that the actor claims to have obtained internal documents from MultiCare’s systems. The disclosure does not quantify how many records were taken, name the specific systems breached, or list exact data types beyond the broad description of internal files. It also does not state a ransom demand or a public negotiation timeline. The posting is the second entry for the same victim, suggesting the initial extortion attempt either failed or required additional pressure through further data publication.

Why This Matters for You and Your Family

When a healthcare organization suffers a ransomware breach, the information at risk often includes personal details that directly affect patients and their households. Even though the exact volume of exposed records remains unknown, any internal files taken from a medical provider can contain names, addresses, dates of birth, Social Security numbers, insurance information, and clinical records. Once these details leave the organization’s control, they become permanent currency for identity thieves, loan fraud, and targeted scams against you or members of your family. Healthcare data is especially damaging because it combines financial identifiers with sensitive medical history that can be used for blackmail or insurance fraud years later.

The Doxxing and Identity-Chain Risk

Stolen internal files rarely stay isolated. Attackers and subsequent buyers frequently cross-reference medical records with other breached datasets to build complete identity profiles. A single leaked email or phone number from this incident can link your healthcare account to gaming usernames, social-media handles, and family addresses. This creates doxxing chains that expose children’s information as well. Credential leaks of this nature often cascade into account takeovers on Steam, Roblox, or other gaming platforms where kids use the same email addresses as their parents’ medical portals. The longer these connections remain unmapped, the higher the chance that one breach becomes dozens of targeted attacks against the entire household.

Everest Ransomware Group’s Track Record

Public reporting attributes the Everest ransomware operation to a double-extortion crew that emerged in 2021. The group is known for compromising organizations across healthcare, education, and manufacturing, then exfiltrating data before encrypting systems. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by lateral movement to locate valuable files. After exfiltration they demand payment to prevent publication, frequently returning to leak additional batches when victims refuse to pay. Everest maintains a leak site that lists both new victims and follow-up postings such as this “pt.2” entry for MultiCare, a pattern observed in several prior campaigns where initial pressure proved insufficient.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, including cleanup of exposed records.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password used at MultiCare or associated healthcare portals wherever it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf.

The MultiCare breach is a reminder that healthcare data rarely travels alone; one ransomware posting can ignite months of follow-on fraud and doxxing attempts against ordinary families. Starting with identity-chain mapping and continuous monitoring gives you the earliest possible warning and hands-on help to close those exposure paths. DoxxScan by GalaxyWarden delivers exactly that combination—continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.