rwrhine.com Listed by safepay Ransomware Group

On January 30, 2025, the dental practice rwrhine.com appeared on the leak site of the safepay ransomware group. Internal files were allegedly exfiltrated following a ransomware attack on the Hayward, California-based office of Dr. Richard W. Rhine. While the exact number of patients affected remains unknown, any individual who has visited the practice in recent years may have personal information now in the hands of criminals.

What's Publicly Reported from Reporting

Public reporting indicates that safepay posted proof of the breach on its dark-web leak site, listing rwrhine.com as a victim. The practice specializes in general and cosmetic dentistry and maintains patient records that typically include names, addresses, dates of birth, Social Security numbers for insurance billing, phone numbers, email addresses, and detailed treatment histories. Available reporting describes the data as internal files exfiltrated during the attack, though the precise volume and full contents have not been independently verified. No public timeline has been released detailing when the initial compromise occurred or how long the attackers had access before encryption and exfiltration.

Why This Matters for You and Your Family

When a local dental office is hit, the impact reaches far beyond the clinic. If you or your children have been patients, the exposed information can be used to file fraudulent tax returns, open accounts in your name, or impersonate you during medical visits. Patient records often contain enough detail for identity thieves to bypass basic security questions at banks or government agencies. For families, a single breach can create months of paperwork and credit monitoring. The sudden appearance on a ransomware leak site means the clock is already ticking; stolen data can circulate quickly among other criminal groups.

The Doxxing and Identity-Chain Implications

Credential leaks from healthcare providers frequently cascade into account takeovers elsewhere. An email and password pair allegedly taken from rwrhine.com may already be reused on personal Gmail, banking sites, or your children’s gaming accounts. Attackers use these connections to map an identity chain that links your professional life, family members, home address, and online handles. Once mapped, the information can fuel doxxing campaigns, targeted phishing, or extortion attempts that feel deeply personal. Gaming accounts belonging to teenagers are especially vulnerable because they often share the same email address as family medical records and lack strong authentication.

Safepay Group’s Publicly Known Track Record

Public reporting attributes safepay with emerging in late 2024 as a ransomware operation that combines encryption with data theft for double extortion. The group has targeted mid-sized businesses across healthcare, professional services, and manufacturing. Its typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by exfiltration of sensitive files before deploying ransomware. Victims are given a short deadline to pay or face public release of stolen data on the group’s leak site. Safepay’s prior victims include other small medical and dental practices, suggesting a focus on organizations that hold detailed personal and financial records but may have limited cybersecurity resources.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, family members’ handles, and real-world identity so you can see exactly what chains back to the rwrhine.com breach.
• Rotate any password you ever used at the dental practice and enable 2FA with an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught within hours rather than months.
• Cover the household with DoxxScan family protection that includes children’s gaming accounts, which often become entry points when medical-record credentials are leaked.
• Let remediation specialists handle data-broker takedown requests and follow-up correspondence so you are not left managing dozens of removal notices yourself.

The rwrhine.com breach is a reminder that even routine medical visits can expose your family to long-term risk. Taking deliberate steps now limits what criminals can build from this single incident. Start your DoxxScan trial and use its continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and family coverage including children’s gaming accounts to close the gaps before the next leak appears.