Raise the Bottom Listed by cmdorganization Ransomware Group

On May 15, 2026, opioid treatment provider Raise the Bottom appeared on the leak site of the ransomware group cmdorganization. The Idaho-based clinic, which serves patients in Boise, Nampa, and Pocatello with medication-assisted treatment including Suboxone, Methadone, and Vivitrol, had internal files exfiltrated during a ransomware attack.

Confirmed Facts from Reporting

Public reporting indicates that cmdorganization posted Raise the Bottom to its leak site on May 15, 2026. The data consists of internal files taken before encryption. The number of individuals whose personal information was exposed remains unknown. Raise the Bottom operates as an outpatient treatment center focused on opioid addiction recovery, involving both patients and their families in care plans. No additional technical details about the initial access method or exact volume of records have been publicly confirmed.

Why This Matters for You and Your Family

If you or a family member have ever sought treatment at Raise the Bottom, your medical history, contact details, and possibly insurance information may now sit in an attacker’s archive. Health records are especially sensitive because they can reveal addiction status, family relationships, home addresses, and phone numbers. Once that information leaves a secure clinic environment, it can be sold, posted, or used to target you with phishing, identity theft, or harassment. Even if you were not a direct patient, spouses, children, or household members listed as emergency contacts or guarantors can also be affected.

The Doxxing and Identity-Chain Implications

Medical breaches like this one frequently cascade beyond the original records. Attackers combine leaked names, addresses, and phone numbers with data from other sources to build detailed profiles. A single email or phone number tied to your treatment record can link your gaming usernames, social media handles, and family members’ accounts. Credential leaks of this nature often lead to account takeovers on personal email, banking, or children’s gaming platforms. The result is a doxxing chain that can expose your full household, including minors, to harassment or further extortion.

Cmdorganization’s Publicly Known Track Record

Public reporting attributes the attack to the ransomware group known as cmdorganization. The group emerged in recent years and has targeted organizations across multiple sectors. Its typical playbook involves gaining initial access, exfiltrating sensitive files, encrypting systems, and then publishing samples of stolen data on a leak site to pressure victims into payment. Notable prior victims have included various healthcare and service providers, though exact details vary by incident. The group’s extortion style relies on the public embarrassment and regulatory risk created by exposing patient or client records.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what this breach connects to.
• Rotate any password you ever used at Raise the Bottom or similar health providers, then enable 2FA with an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests and broker removals for you while you focus on securing accounts and talking with affected family members.

The incident shows how quickly health data can move from a trusted clinic to public leak sites, underscoring the need for proactive personal defense. Start your DoxxScan trial today and use its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family coverage—including children’s gaming accounts—to reduce the damage from breaches like this one before they spread further. DoxxScan by GalaxyWarden gives ordinary families the same visibility and response capabilities that organizations use after attacks.