Raphael Ortho Listed by Genesis Ransomware Group

On March 31, 2026, dental practice management company Raphael Ortho appeared on the leak site of the genesis Ransomware Group, with the attackers claiming to have exfiltrated internal files during a ransomware incident.

What Public Reporting Shows

Public reporting indicates that Raphael Ortho, which provides management services to dental practices, was listed on the Genesis leak portal hosted on the dark web. The entry states that internal files were taken during a ransomware attack, though the exact number of patients or employees whose records were affected remains unknown. Available reporting describes the data as internal files without specifying the precise volume or types of records, such as patient names, addresses, Social Security numbers, insurance details, or treatment histories. The listing appeared on the group's onion site, accessible only through Tor, and follows the group's standard practice of publishing samples or announcements after encryption and failed ransom negotiations.

Why This Matters for You and Your Family

When a company that handles dental practice records suffers a breach, the information involved often includes personal details that can be used for identity theft, insurance fraud, or targeted scams against you or your children. Patient records frequently contain dates of birth, addresses, phone numbers, and sometimes Social Security numbers — exactly the building blocks criminals need to open accounts in your name or file false tax returns. Even if you never directly interacted with Raphael Ortho, your dentist's management provider may have held your family's information. Once exposed, these details do not expire. Criminals trade and combine them for years, increasing the chance that someone will target your family with phishing emails, fake dental insurance calls, or worse.

The Doxxing and Identity-Chain Risks

Credential leaks and internal file exposures like this one frequently cascade into doxxing chains. An email or username taken from a healthcare vendor can be tested across gaming platforms, social media, and email providers. If your child uses the same email for Roblox, Fortnite, or Discord that appears in the Raphael Ortho files, that gaming account becomes an easy target for takeover. Attackers then use in-game chats or linked profiles to gather more personal information, mapping handles back to real-world identities. This identity-chain effect turns a single breach into repeated harassment, swatting, or extortion attempts. Public reporting on similar incidents shows that gaming accounts are often the first domino to fall once personal data surfaces on dark web markets.

Genesis Ransomware Group's Track Record

Public reporting attributes the group's emergence to 2024, when it began listing victims on its dedicated leak site. Notable prior victims have included organizations across healthcare, education, and professional services sectors. The group's typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by claimed exfiltration of sensitive files before deploying ransomware. They then demand payment to prevent publication, using a double-extortion model that combines encryption with public shaming on their onion site. When victims refuse to pay, the group releases samples or full datasets, as appears to have happened with Raphael Ortho.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what the Raphael Ortho exposure connects to.
• Rotate the password used at any dental or healthcare provider anywhere it is reused, and immediately enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children's gaming accounts that often chain back to the same addresses and emails.
• Let the remediation specialists handle takedown requests across data brokers and suspicious sites for you while you focus on securing your own accounts.

The Raphael Ortho breach is a reminder that healthcare vendors hold information that can affect entire families long after the initial incident. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children's gaming accounts vulnerable to credential-stuffing attacks like those following this incident.