Primeimaging Data Leak Listed by Everest Ransomware Group

On March 28, 2024, medical imaging provider Prime Imaging appeared on the leak site of the Everest ransomware group. The listing states that attackers exfiltrated internal files during a ransomware incident and published links to roughly 200 GB of data that include personal medical records, oncology results, client and employee personal information, passports, and other documents. The company has not yet issued a public breach notification quantifying how many individuals are affected.

Details from the Leak-Site Listing

The Everest leak page, archived via ransomware.live, explicitly names Prime Imaging and provides multiple GoFile download links containing the claimed material. It describes the data as “personal medical records, onco results, clients and employee personal data, passports and other documents.” The listing does not specify the exact number of records exposed or name the initial access vector used. No ransom demand figure is published on the page, and the disclosure gives no deadline beyond the standard pressure tactics typical of the group.

Why This Matters for You and Your Family

If you or any member of your household has ever been a patient at Prime Imaging, worked there, or had a family member treated there, your sensitive health information and identity documents may now sit in an attacker-controlled archive. Medical records and oncology results are especially damaging because they can be used for insurance fraud, employment discrimination, or targeted scams that reference your exact diagnosis. Employee data and scanned passports add concrete personally identifiable information that can be combined with other leaks to build a complete profile of you and your relatives.

The Doxxing and Identity-Chain Risks

Health data rarely travels alone. A single exposed email, phone number, or passport scan quickly links to your social-media handles, children’s gaming accounts, and other breached services. Attackers chain these fragments across dozens of platforms, creating persistent doxxing profiles that can lead to swatting, identity theft, or extortion attempts years later.

Everest Ransomware Group Track Record

Public reporting attributes the Everest ransomware group with emerging in 2021. The gang has since listed hundreds of victims, including healthcare providers, manufacturers, and professional services firms. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of sensitive files before encryption. They then publish samples on their leak site and apply dual pressure through direct extortion emails to executives and public shaming. The group’s focus on healthcare data has been consistent, making any Everest listing a high-priority incident for affected families.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including cleanup of exposed records.
• Rotate any password you ever used at Prime Imaging or related employee systems, and enable 2FA through an authenticator app everywhere that credential is reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same leaked address or parent credentials.
• Let remediation specialists handle data-broker takedown requests and persistent leak cleanup on your behalf.

The incident underscores how quickly medical and identity records can move from a single provider’s network into the hands of organized extortion operators. Acting promptly limits how far those chains can extend. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers. Start your DoxxScan trial today to regain control of your exposed information.