Pureform Radiology Center Listed by Everest Ransomware Group

On September 23, 2024, the Everest ransomware group listed Pureform Radiology Center on its leak site, claiming that the Canadian medical imaging provider had been hit by a ransomware attack in which internal files were exfiltrated. The disclosure indicates that all medical records and internal documents were stolen, and it highlights the discovery of what the group claims is a zero-day exploit in software belonging to the company that acquired Pureform. Anyone whose imaging, diagnostic, or administrative records passed through Pureform Radiology Center may now have their personal health information and other sensitive details exposed.

Reported Details from the Listing

The Everest leak-site entry states that attackers gained access to Pureform Radiology Center’s systems and exfiltrated internal files. It explicitly claims the theft included all medical records along with other internal documents. The posting does not quantify the number of affected individuals, nor does it provide a precise timeline of the initial intrusion or the date of data exfiltration. The listing also notes that Pureform’s president engaged a recovery negotiator, though it does not detail the outcome of those discussions or any ransom demand amount. The primary disclosure source remains the Everest onion site, mirrored on ransomware tracking platforms such as ransomware.live.

Why This Matters for You and Your Family

Medical imaging centers like Pureform handle highly sensitive personal information: names, dates of birth, health insurance numbers, diagnostic images, radiology reports, and often Social Insurance Numbers or driver’s licence details for billing. When this data leaves controlled systems, the exposure risk is permanent. You or your family members who had scans, ultrasounds, MRIs, or X-rays at Pureform now face the possibility that their full health history could be used for identity theft, insurance fraud, or targeted phishing. The disclosure does not specify exactly which data fields were taken, so the safest assumption is that everything stored on the compromised systems must be treated as exposed.

Doxxing and Identity-Chain Risks

Health data rarely travels alone. A radiology record typically links your legal name, date of birth, address, and phone number to your medical history. Attackers can combine this with any usernames, email addresses, or passwords found in the internal documents to build an identity chain that reaches your online accounts, workplace systems, and even your children’s profiles. Credential leaks of this nature frequently cascade into gaming account takeovers, where a child’s username and reused password grant intruders entry to Discord, Steam, or Roblox accounts tied to the same household address. Once initial access is achieved, doxxing accelerates: public records, social-media handles, and breached health details are stitched together to create detailed profiles that can be sold or used for extortion. The longer these chains remain unmapped, the higher the chance of follow-on targeting months or years after the initial breach.

Everest Ransomware Group’s Track Record

Public reporting attributes the Everest ransomware operation to a group that first appeared in 2020 and has since conducted hundreds of attacks globally. The group is known for double-extortion tactics: encrypting victim systems while simultaneously exfiltrating data to pressure payment. Notable prior victims include healthcare providers, manufacturers, and professional services firms across North America and Europe. Everest typically gains initial access through phishing, remote desktop protocol brute-force, or exploited vulnerabilities, then moves laterally to locate high-value folders before exfiltrating them. After exfiltration the group posts samples on its leak site and sets payment deadlines, often threatening to release full archives if demands are not met. In the Pureform case the listing also references a claimed zero-day in acquisition-related software, a detail consistent with Everest’s pattern of highlighting technically interesting finds to increase leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and other exposures.
• Rotate any password you ever used at Pureform Radiology Center or its affiliated systems, especially if it appears in reused form across email, banking, or work accounts.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your household is flagged within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address and personal details.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that arise from the medical and personal information now circulating.

The Pureform Radiology Center breach is a reminder that healthcare providers remain high-value targets and that one compromised radiology visit can feed long-term identity abuse. By treating the exposure as permanent and actively breaking the identity chains it creates, you limit what criminals can build from your data. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give families the practical tools needed to respond effectively.