Team Locum Listed by dragonforce Ransomware Group

On April 9, 2024, UK healthcare staffing agency Team Locum appeared on the leak site operated by the dragonforce ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, which specialises in placing locum pharmacists, optometrists, carers and other healthcare workers across the UK, has not yet published a public breach notification quantifying how many individuals are affected.

Details from the Leak Site

The dragonforce leak site entry states that internal files were taken. It does not specify the volume or exact categories of data involved, nor does it list sample records. The disclosure indicates the data was obtained through a ransomware deployment, after which the threat actors encrypted systems and threatened to publish the stolen material unless a ransom was paid. As of the listing date, the group had not released any samples publicly, a common tactic used to pressure victims into negotiation. The exact number of people whose personal or employment records were taken remains unknown from the primary source.

Why This Matters for You and Your Family

If you have ever worked with a locum agency, registered as a pharmacist, optometrist, carer or other healthcare professional through Team Locum, or had your details held as a client or patient contact, your information may now sit in an attacker-controlled archive. Healthcare staffing records frequently contain full names, home addresses, dates of birth, National Insurance numbers, banking details for payments, professional registration numbers and phone numbers. Exposure of this combination creates immediate risks of identity theft, fraudulent loan applications and targeted scams that can affect your finances and credit score for years. Even if you are not a healthcare worker yourself, family members listed as emergency contacts or joint account holders can also be pulled into the same risk pool.

The Doxxing and Identity-Chain Risk

Ransomware leaks rarely stop at one dataset. Once internal files leave a company network they often circulate among multiple criminal groups who link the information with other breaches. A phone number taken from a Team Locum record can be matched to your email address from an earlier breach, then to a username you use on social media or gaming platforms. This creates an identity chain that makes doxxing, SIM-swapping and account takeovers far easier. Credential leaks like this one cascade into gaming account takeovers, especially for children or teenagers who reuse passwords or security questions that appear in professional records. The longer the data sits on dark-web forums, the more complete the picture criminals can build about you and your household.

Dragonforce’s Known Track Record

Public reporting attributes the emergence of dragonforce to late 2023. The group has claimed responsibility for attacks on organisations across Europe and North America, often targeting mid-sized businesses in healthcare, education and professional services. Their typical playbook begins with initial access gained through phishing, compromised remote desktop credentials or exploitation of unpatched VPN appliances. Once inside, they exfiltrate documents before deploying ransomware. Extortion follows a double-pressure model: encryption of victim systems combined with the threat of data publication on their leak site. The group has shown willingness to release small samples of stolen data to demonstrate seriousness, then escalate pressure with countdown timers. While not the largest ransomware operation, dragonforce maintains a consistent presence on ransomware leak-site aggregators and continues to add new victims monthly.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real-world identity, using cleanup handled by specialists.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on within hours rather than months.
• Rotate any password you have used with Team Locum or any healthcare staffing portal, and enable two-factor authentication through an authenticator app everywhere that password was reused.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that can be chained back to the same address or parent details.
• Let remediation specialists manage takedown requests for any exposed personal records appearing on data-broker or underground sites.

The incident underscores that even specialist agencies holding professional records are now routine targets. Acting quickly on the information that has already leaked, while establishing ongoing visibility into future exposures, remains the most practical defence available to ordinary people and their families. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-based attacks.