Southwest Healthcare Services Listed by Donutleaks Ransomware Group

On October 22, 2022, Southwest Healthcare Services appeared on the leak site operated by the donutleaks ransomware group. The nonprofit healthcare provider serving southwest North Dakota and northwest South Dakota may have had its internal files exfiltrated during a ransomware attack, with the threat actors posting a full data download link on their onion site.

Details from the Leak Listing

The donutleaks listing states that Southwest Healthcare Services suffered a ransomware intrusion in which attackers extracted internal files. The disclosure does not quantify the number of affected records, name specific data types such as patient records or employee information, or reveal the ransom amount demanded. It simply states that data was taken and now sits on the leak site with a downloadable archive. The primary source, hosted on the Tor network and indexed by ransomware.live, remains the sole official public disclosure; no separate regulatory filing or company breach notification has surfaced with additional specifics.

October 22, 2022 marks the first public confirmation of the incident through the attackers’ own leak portal. Because the listing does not detail what was taken, the exact scope of exposure remains unknown to the public.

Why This Matters for You and Your Family

If you or anyone in your household has received care from Southwest Healthcare Services, your personal health information or related administrative records may have been stolen. Healthcare data breaches carry long-term risk because medical details are difficult to change and can be used for insurance fraud, prescription scams, or targeted social engineering. Even when the leak site does not list exact record counts, the presence of internal files means names, addresses, dates of birth, Social Security numbers, or treatment histories could be circulating among criminals.

Ordinary families in rural North Dakota and South Dakota are disproportionately affected. Many residents rely on this nonprofit for their only local healthcare options, so the breach touches everyday people rather than a narrow corporate audience.

The Doxxing and Identity-Chain Risks

Stolen internal files from healthcare providers frequently contain enough personal identifiers to link an individual’s real name to email addresses, phone numbers, insurance details, and sometimes even family member information. Once criminals possess these connections, they can build doxxing chains that follow you across the internet. A single leaked email can unlock gaming accounts, social media profiles, or financial services where the same password was reused.

Credential leaks like this one cascade into account takeovers and doxxing chains, especially when children’s information appears alongside a parent’s. Gaming usernames tied to a family address can be hijacked, leading to further harassment or extortion attempts that feel intensely personal.

Donutleaks Ransomware Group Track Record

Public reporting attributes donutleaks with a series of extortion-focused ransomware campaigns that emerged in 2022. The group typically gains initial access through phishing or exploited remote desktop protocols, exfiltrates sensitive files before deploying encryption, and then posts samples or full archives on its dark-web leak site when victims refuse to pay. Notable prior targets have included smaller healthcare organizations and regional service providers where the attackers leverage the sensitivity of the data to pressure payment. Their playbook emphasizes public shaming through downloadable leaks rather than prolonged negotiation, increasing the chance that stolen information ends up in the hands of identity thieves even if the victim eventually pays.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at Southwest Healthcare Services or related portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The Southwest Healthcare Services breach underscores how quickly a single healthcare provider’s compromise can ripple into lifelong identity risk for ordinary families. Staying ahead requires more than reactive checks; it demands ongoing visibility and expert intervention. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers.