phitoformulas.com.br Listed by lockbit3 Ransomware Group

On August 19, 2023, Brazilian compounding pharmacy phitoformulas.com.br appeared on the LockBit 3.0 ransomware leak site with the claim that its internal files had been exfiltrated. The listing, hosted on the LockBit infrastructure and mirrored on ransomware.live, states that data was taken during a ransomware attack but does not specify the volume of records, the exact types of documents, or any ransom amount demanded.

Reported Details from the Listing

The primary disclosure on the LockBit 3.0 leak site indicates that internal files were successfully exfiltrated from Phito Formulas, a company specializing in compounded medications compliant with ANVISA regulations. No customer record count is published, and the listing does not detail whether personal information such as names, addresses, health data, or payment records was included. The disclosure simply states that data was taken and warns of impending publication if demands are not met. As is typical with these sites, the exact deadline and any negotiation details remain private between the operator and the victim.

Why This Matters for You and Your Family

When a pharmacy’s internal files are stolen, the exposure can reach far beyond the company. Customers who ordered compounded drugs often provide sensitive health details, prescription histories, and contact information. If those records are among the exfiltrated material, your family’s medical privacy is now at risk. Even without exact numbers, the high severity rating reflects the potential for identity theft, insurance fraud, or targeted scams that exploit health-related data. Ordinary families who trusted this pharmacy with prescriptions for themselves or their children face months or years of possible fallout once the files surface on underground forums.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain spreadsheets that link names, emails, phone numbers, addresses, and sometimes national ID numbers. Threat actors and data brokers then chain these details with usernames found in other breaches, creating a complete identity profile. A single leaked pharmacy record can expose not only your health information but also the gaming accounts or social-media handles tied to the same household email. This cascade turns one breach into persistent doxxing threats, account takeovers, and harassment that can affect every member of the family, including children whose usernames are often linked to parental contact details.

LockBit 3.0’s Known Track Record

Public reporting attributes the LockBit 3.0 variant to a ransomware operation that first appeared in 2020 and rebranded multiple times to evade sanctions. The group has hit hospitals, manufacturers, and professional-service firms across dozens of countries. Its typical playbook involves initial access through compromised remote-desktop credentials or exploited vulnerabilities, followed by rapid exfiltration of documents before encryption. LockBit operators then publish samples on their leak site and threaten full data release or auction unless payment is made. While some victims quietly pay, many see partial or complete datasets leaked regardless, feeding the group’s reputation for aggressive double-extortion tactics.

What to do

• Rotate any password you used at phitoformulas.com.br anywhere else it appears, and switch to 2FA through an authenticator app rather than SMS.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts commonly chained to the same contact details.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal records that appear on data-broker or extortion sites.

The incident shows once again that health-related data breaches create long-term identity risks that do not disappear when the news cycle moves on. Starting proactive steps now can limit how far this exposure travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks.