rhp.com.br Listed by lockbit3 Ransomware Group

On August 29, 2024, Brazilian healthcare provider rhp.com.br appeared on the LockBit 3.0 leak site with the ransomware group claiming to have exfiltrated more than 70,000 patient, staff, contractor, and investor records along with other internal files.

Reported Details from the Listing

The LockBit 3.0 leak page states that rhp.com.br suffered a ransomware attack in which internal files were exfiltrated. The posting claims the stolen data includes information on more than 70,000 patients, staff members, contractors, and investors. The disclosure does not specify the exact systems compromised or provide a full inventory of every file type taken. It also does not state the precise date of initial compromise or the ransom amount demanded. The listing follows the group’s standard format of publishing a sample of allegedly stolen data and setting an extortion deadline, after which additional material may be released or sold.

Why This Matters for You and Your Family

If you or any member of your household has received care from rhp.com.br, worked there, contracted with the organization, or invested in it, your personal information may now sit on a dark-web server controlled by extortionists. Patient records, employee files, and investor documents frequently contain full names, dates of birth, national identification numbers, addresses, phone numbers, email accounts, and in many cases financial or insurance details. Once exposed, this data does not disappear. It circulates among brokers who package it for identity thieves, phishing campaigns, and long-term fraud schemes. Your family’s medical history, employment records, and financial relationships can be weaponized for years.

Doxxing and Identity-Chain Risks

A single breach like this rarely stays isolated. Threat actors and data brokers routinely cross-reference leaked emails, phone numbers, and names against gaming accounts, social-media handles, and public records. The result is an identity chain that can reveal where you live, where your children attend school, and which online services control your finances or communications. Credential leaks of this nature often cascade into account takeovers on Steam, Roblox, Discord, or other platforms used by children and teenagers. A compromised gaming account tied to a parent’s email can quickly expose household addresses and family photos, feeding further doxxing campaigns.

LockBit 3.0 Track Record

Public reporting attributes LockBit’s original operations to actors who first appeared in 2019 under the name “LockBit 1.0.” The group rebranded to LockBit 2.0 in 2021 and released the LockBit 3.0 variant in 2022. It has targeted hospitals, schools, manufacturers, and government agencies across dozens of countries. Typical playbook includes initial access via compromised remote-desktop credentials or vulnerable web applications, followed by rapid exfiltration of internal shares before encryption. The group runs a ransomware-as-a-service model, allowing affiliates to use its infrastructure while LockBit takes a cut of any ransom paid. When victims refuse to pay, LockBit publishes samples and pressures partners, customers, and employees directly. The rhp.com.br listing fits this established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you ever used at rhp.com.br or related services and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential chaining.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The rhp.com.br breach is another reminder that healthcare data rarely stays contained once it leaves the building. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain that begins with this single listing. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.