sundanceliving.com Listed by RansomHub Ransomware Group

On February 12, 2025, the ransomware group RansomHub added sundanceliving.com to its leak site, claiming that internal files had been exfiltrated from Sundance Retirement Communities, which operates independent living, assisted living, and memory care facilities across the United States.

What Public Reporting Shows

Public reporting indicates the incident stems from a ransomware attack in which attackers gained access to the organization’s systems, exfiltrated data, and later listed the victim on the RansomHub leak portal. The exact number of individuals whose information was taken remains unknown. Available reporting describes the exposed material as internal files; specific record counts or categories of personal data have not been publicly detailed. The listing appeared on the group’s onion site, a common venue where ransomware operators publish samples or pressure victims to pay.

Why This Matters for You and Your Family

If you or an older relative has lived at, inquired about, or worked with a Sundance Retirement Community, your information could be among the stolen files. Retirement and senior-care providers routinely collect names, addresses, dates of birth, Social Security numbers, medical details, insurance information, and family contact records. Once such data leaves the company’s control, it can be sold, traded, or used to target you with identity theft, fraudulent loans, tax scams, or phishing emails that appear to come from a familiar care facility. Older adults and their adult children are frequent targets because financial decisions often involve multiple family members, creating extra opportunities for fraud.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain email addresses, usernames, or phone numbers that link to personal accounts elsewhere. Attackers can use these to map your online presence, locate children’s gaming accounts that share the same family address or recovery email, and build a complete identity chain. A single credential leak from a senior-care provider can cascade into account takeovers on email, banking, or social media, followed by doxxing or extortion. Public reporting on similar incidents shows that gaming platforms are often the next stop in these chains because kids and teens reuse passwords or security questions tied to a parent’s data.

RansomHub’s Publicly Known Track Record

Public reporting attributes RansomHub’s emergence to mid-2024. The group has since listed hundreds of victims across healthcare, manufacturing, education, and technology sectors. Notable prior targets include organizations whose employee and customer records appeared on the same leak site. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of sensitive files, encryption of systems, and dual extortion: demanding payment to decrypt data while threatening to publish stolen information if the ransom is not paid by their deadline.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what chains back to the Sundance breach.
• Rotate any password you used at sundanceliving.com or any Sundance-related service, then enable two-factor authentication through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed within hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same family address or recovery details.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing accounts and talking with affected family members.

The incident is a reminder that data collected by care providers can affect every generation in a family. Acting quickly limits how far the stolen information can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to the same credential cascades seen in attacks like this one.