On October 25, 2023, St Raphael's Hospice appeared on the leak site operated by the noescape ransomware group. The UK palliative care provider, which serves the 401,000 residents of Sutton and Merton, is claimed to have had internal files exfiltrated during a ransomware attack. The disclosure indicates that patient referrals come from GPs, hospital doctors, and clinical nurse specialists, meaning the stolen data likely touches thousands of families facing serious illness.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch St Raphael'S Hospice
Get alerted the next time St Raphael'S Hospice files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about St Raphael'S Hospice’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak Site
The noescape leak-site listing states that St Raphael's Hospice suffered a ransomware intrusion and that attackers successfully exfiltrated internal files. The posting does not quantify the number of records affected, nor does it list specific data types beyond claiming that internal files were taken. A sample of the allegedly stolen material was published on the onion site to support the group's claim. The notification does not detail the initial access vector or the exact date of the intrusion, only that exfiltration occurred and that the organisation now faces public exposure of the stolen material if demands are not met.
Why This Matters for You and Your Family
When a hospice that coordinates end-of-life care is breached, the families who rely on it suddenly face heightened privacy risks. Medical correspondence, referral notes, contact details, and potentially carer information can appear in criminal hands. Internal files exfiltrated in ransomware attack often contain names, addresses, phone numbers, dates of birth, and clinical identifiers that are difficult to change. For ordinary people already under stress, this exposure adds another layer of worry: the possibility that personal health details or family contact information will be sold or leveraged in future scams. Even though the exact volume of data is unknown, the nature of a hospice's work means the breach touches some of the most sensitive moments in a family's life.
Doxxing and Identity-Chain Implications
Health-related records are high-value currency in underground markets because they link real identities to addresses, relatives, and sometimes financial circumstances. Once attackers possess these files, they can cross-reference them with other breaches to build detailed profiles. A single leaked email or phone number from the hospice can be chained to gaming accounts, social-media handles, or reused passwords, rapidly turning a medical breach into full-spectrum identity compromise. Credential leaks like this one frequently cascade into account takeovers, especially for families who share devices or reuse credentials across work, personal, and children's gaming accounts. The result is doxxing that can expose home addresses, family relationships, and vulnerable health histories to harassment or fraud.