River City Eye Listed by genesis Ransomware Group

On September 25, 2025, the Genesis ransomware group added River City Eye, an optometry clinic with locations in Portland’s Hollywood District and Happy Valley, Oregon, to its public leak site after the business failed to meet an extortion deadline. Internal files were allegedly exfiltrated during the ransomware attack, exposing patient and employee records that could now circulate beyond the initial breach.

What's Publicly Reported from Reporting

Public reporting indicates the clinic’s data appeared on the Genesis leak portal hosted on the dark web. The listing states that attackers successfully exfiltrated internal files before encrypting systems or demanding payment. No exact victim count has been released, but as a working optometry practice the breach likely includes names, contact details, dates of birth, Social Security numbers, insurance information, and clinical records for patients and staff. The Genesis group set a publication deadline that the clinic did not satisfy, triggering the public release of the stolen data.

Why This Matters for You and Your Family

If you or any member of your family has visited River City Eye in the past several years, your personal health and identity information may now sit in criminal databases. Medical records are especially damaging because they combine sensitive health details with the exact data needed for identity theft, insurance fraud, or targeted scams. Once stolen, this information rarely disappears. It can surface months or years later when criminals piece together profiles for phishing, loan fraud, or doxxing. For families, a single breach like this can affect multiple generations if parents, children, or grandparents share the same address or phone number listed in patient files.

The Doxxing and Identity-Chain Implications

Health-clinic data rarely stays isolated. Attackers routinely cross-reference leaked patient records with usernames, email addresses, and phone numbers found in other breaches. This creates an identity chain that links your real name and home address to gaming accounts, social-media handles, and family members. Credential leaks of this kind frequently cascade into account takeovers, especially for children’s gaming profiles that often reuse the same email or password as a parent’s medical portal. The result is not just identity theft but full doxxing: home addresses, children’s names, and daily routines suddenly become public. Available reporting describes these chains accelerating once initial medical or financial data reaches underground marketplaces.

Genesis Ransomware Group Track Record

Public reporting attributes the attack to the Genesis ransomware group, which emerged in early 2024 and has since listed dozens of small-to-medium businesses and healthcare providers. Notable prior victims include regional medical practices, dental offices, and local service companies whose internal files were published after failed ransom negotiations. The group’s typical playbook involves initial access through phishing or exploited remote-desktop credentials, followed by rapid exfiltration of documents, then extortion via dual pressure: encryption of systems combined with threats to publish sensitive patient or employee data. Genesis maintains a leak site that updates on a near-weekly basis, using countdown timers to compel payment.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the River City Eye breach.
• Rotate any password you ever used at the clinic anywhere it has been reused, and immediately enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and your children’s gaming accounts, which often become the next target once medical credentials surface.
• Let remediation specialists handle takedown requests across data brokers and leak forums while you focus on securing your own accounts.

The incident shows that even neighborhood clinics can become gateways to long-term identity exposure for ordinary families. Acting quickly on the exposed data gives you the best chance of limiting damage before criminals complete their identity chains. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting protective measures now can prevent this claimed breach from becoming the first link in a larger compromise of your family’s privacy.