MultiCareInc pt.3 Listed by Everest Ransomware Group

On October 18, 2022, healthcare provider MultiCareInc appeared as “pt.3” on the leak site operated by the Everest ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, although the exact number of records affected and the specific types of data taken remain undisclosed by the group.

Details from the Leak-Site Listing

The Everest leak page explicitly names MultiCareInc and claims the organization suffered a ransomware intrusion in which attackers copied internal files before encryption. No sample data is shown on the public page, and the disclosure does not quantify how many patient records, employee files, or other documents were taken. The listing follows the group’s standard format: a victim name, a brief statement that data was allegedly stolen, and an implied deadline for payment to prevent further publication. Because the primary source is the attackers’ own site, independent verification of the volume or sensitivity of the material is not yet available.

Why This Matters for You and Your Family

When a healthcare organization’s internal files are stolen, the information inside often includes names, dates of birth, Social Security numbers, medical histories, insurance details, and addresses for patients and staff. Even without an exact count, any family member who has received care at a MultiCare facility could have their personal data exposed. Medical records are especially damaging because they reveal sensitive conditions, treatments, and financial relationships that identity thieves can exploit for insurance fraud, prescription scams, or targeted phishing. If your family has ties to the affected provider, this claimed breach creates a direct risk that your information could surface in fraud schemes or be sold on underground markets.

The Doxxing and Identity-Chain Risks

Stolen internal files rarely contain only one data point. A single spreadsheet can link your name to an email address, phone number, date of birth, and sometimes even login credentials used for patient portals. Attackers then chain these pieces together with data from earlier breaches to build a complete profile. That profile can be used to hijack email accounts, reset bank passwords, or impersonate you to government agencies. Credential leaks of this kind also cascade into gaming platforms: children’s accounts that reuse an email or password from a parent’s healthcare registration become easy targets for takeover, leading to further doxxing when usernames, IP addresses, and linked social profiles are exposed.