Primary Plus Listed by qilin Ransomware Group

On December 11, 2024, Primary Plus, a dental care provider with offices in Vanceburg and Maysville, Kentucky, was listed on the leak site of the qilin ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company has not yet published a formal breach notification, and the exact number of individuals whose information may be affected remains unknown.

Details from the Leak Site

The qilin leak site entry states that Primary Plus suffered a ransomware incident in which attackers successfully exfiltrated internal files. The disclosure does not specify the volume or exact types of data taken, nor does it list sample records. It simply states that the files are now available for download by authorized parties on the extortion platform. The listing carries a deadline typical of qilin’s playbook, after which the group threatens to publish or sell the data. Because Primary Plus has not released a public statement quantifying impact, the full scope of exposed patient or employee records cannot be confirmed from the primary disclosure.

Why This Matters for You and Your Family

If you or your family members have received dental care at Primary Plus’s Vanceburg or Maysville locations, your personal information may now sit in an attacker-controlled archive. Dental offices routinely collect names, addresses, dates of birth, Social Security numbers for insurance billing, phone numbers, email addresses, and detailed treatment records. Once exfiltrated, this information fuels identity theft, insurance fraud, and targeted phishing campaigns. Even when the exact number of affected records is unknown, the high severity rating reflects the sensitivity of healthcare data and the ease with which it can be weaponized against ordinary families.

Doxxing and Identity-Chain Risks

Healthcare breaches rarely stop at the initial leak. Attackers combine stolen patient files with credentials from other breaches to build detailed identity chains. A dental patient’s email and password reused at an online shopping site or children’s gaming account can quickly lead to full account takeover. Public records, social-media handles, and phone numbers harvested from the Primary Plus files can be cross-referenced to dox family members, locate home addresses, or impersonate relatives in financial scams. These chains often surface first on underground forums before mainstream consequences appear.

Qilin’s Publicly Known Track Record

Public reporting attributes the emergence of the qilin ransomware group to mid-2022. Since then the gang has targeted organizations across healthcare, education, and small business sectors. Notable prior victims include municipal governments and regional medical providers. Qilin typically gains initial access through phishing or exploited remote desktop credentials, exfiltrates data before deploying encryption, and then posts samples on its leak site with escalating pressure tactics. The group’s dual extortion style—threatening both data publication and potential sale to third parties—has become its signature. While exact success rates are difficult to verify, public trackers show qilin maintains an active leak site and continues to add new victims monthly.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by Warden specialists.
• Rotate any password you ever used at Primary Plus or related dental portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household—DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that appear after this incident.

The Primary Plus listing is a reminder that even local healthcare providers remain high-value targets. Acting quickly on credential hygiene and identity mapping can break the chain before criminals turn stolen dental records into long-term fraud or doxxing campaigns. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to gain visibility and control over what attackers already hold.