sehma.com Listed by threeam Ransomware Group

On February 1, 2025, the ransomware group known as threeam added sehma.com to its public leak site, claiming that it had exfiltrated internal files from SEHMA, a home health care provider network that delivers nursing, infusion, durable medical equipment, and diagnostic services to patients across multiple locations.

Reported Details of the Incident

Public reporting indicates the incident began as a ransomware attack in which threeam gained access to SEHMA’s internal systems, copied sensitive files, and later listed the victim on its dark-web leak page. The exact number of individuals affected remains unknown, but the data includes internal documents that would typically contain protected health information, employee records, vendor contracts, and operational details. No specific deadline for ransom payment has been publicly disclosed in available reporting, though ransomware groups routinely set short windows before releasing more data.

The listing appears on the group’s dedicated leak site, hosted on an onion domain, and was first indexed by ransomware tracking services such as ransomware.live. SEHMA has not yet issued a public statement confirming the breach or detailing the precise scope of exposed records.

Why This Matters for You and Your Family

When a health-care provider’s internal files are stolen, the information often includes names, addresses, dates of birth, Social Security numbers, medical histories, insurance details, and sometimes family member contacts. If you or anyone in your household has received care from SEHMA or one of its affiliated companies, your personal health and financial data may now sit in the hands of criminals. That information can be sold, used for identity theft, or combined with other leaks to build a complete profile of your family.

Medical data is especially damaging because it can be leveraged for insurance fraud, prescription scams, or blackmail. Even if you were not a direct patient, employees of SEHMA or business partners may have had their payroll records, tax forms, or contact lists exposed, creating risk that reaches beyond the patient list.

The Doxxing and Identity-Chain Risks

Stolen internal files rarely stay isolated. Attackers frequently cross-reference newly obtained data with information already circulating on breach forums. A single email address or phone number from the SEHMA leak can be linked to your accounts on other services, turning one breach into a chain of compromises. Public reporting shows this pattern repeatedly leads to doxxing, where attackers publish home addresses, family member names, and even children’s usernames to increase pressure or extract additional payments.

Credential leaks from incidents like this often cascade into gaming account takeovers. Children’s Roblox, Fortnite, or other platform accounts tied to a parent’s email can be hijacked, used to spread malware, or exploited to harass the family. The same identity chain that exposes work or medical data can therefore endanger your children’s online identities within hours of the information appearing on underground markets.

Threeam’s Publicly Known Track Record

Public reporting attributes the threeam ransomware group with emerging in late 2023. It has since targeted hospitals, manufacturers, and professional service firms. Notable prior victims include health-care organizations and mid-sized businesses whose internal documents were published after ransom demands went unmet. The group’s typical playbook involves initial access through phishing or exploited remote desktop credentials, followed by rapid exfiltration of sensitive files and deployment of ransomware to encrypt systems. Extortion combines encryption pressure with public leaks on its onion site, often releasing small samples first and threatening to publish the full archive if payment is not received.

What to Do

• Rotate any password you used at SEHMA or any affiliated health-care portal and enable 2FA through an authenticator app everywhere that password was reused.
• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so hidden connections surface before criminals exploit them.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed within hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which frequently become targets once a parent’s credentials appear in leaks like this one.
• Let remediation specialists handle data-broker takedown requests and other cleanup steps so you do not have to chase every site manually.

The speed with which ransomware data moves from leak sites into criminal marketplaces leaves little room for delay. Starting protective steps now can limit how far this incident reaches into your life. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage extends to children’s gaming accounts that often become the next link in the doxxing chain after a health-care breach.