The Foot Doctor's Listed by Space Bears Ransomware Group

On November 13, 2025, the Wyoming-based podiatry practice known as The Foot Doctor's appeared on the leak site of the spacebears ransomware group. Internal files containing patient and operational data were allegedly exfiltrated during a ransomware attack on the clinic in Casper, Wyoming.

What Public Reporting Shows

Public reporting indicates the clinic’s patient records and internal documents were taken. The practice, which treats everyday foot and ankle conditions, is run by Dr. Michael P. Wilkinson, a board-certified podiatric surgeon. No exact victim count has been released, but the breach affects current and former patients whose personal information was stored in the compromised systems. The data was posted to the group’s .onion leak site, making it accessible to anyone who reaches the page.

November 13, 2025 marks the public disclosure date on the ransomware leak site. The exposed materials consist of internal files rather than a single structured database, which often include scanned documents, correspondence, and records that can contain names, addresses, dates of birth, phone numbers, and medical details.

Why This Matters for You and Your Family

When a local medical provider is hit, the people affected are rarely large corporations. They are families who scheduled appointments for heel pain, sports injuries, or routine diabetic foot care. If your information was in those files, it can be used to impersonate you, file fraudulent insurance claims, or combine with other leaks to build a more complete picture of your life. Medical data is especially sensitive because it can reveal conditions that criminals later exploit through phishing or social engineering aimed at your household.

Even if you cannot confirm whether your records were taken, the uncertainty itself creates stress. Families must now watch for unexpected medical bills, insurance denials, or suspicious calls referencing foot-related appointments they never had.

The Doxxing and Identity-Chain Implications

Medical breaches rarely stop at the initial leak. Patient files frequently contain home addresses, phone numbers, email accounts, and sometimes names of family members. Attackers chain this information with credential leaks from other services to take over email, banking, or social media accounts. A single exposed email and password from one breach can unlock multiple services if you reuse credentials.

Credential leaks like this one cascade into account takeovers and doxxing chains. Children’s names or dates of birth listed on family medical forms can link to their gaming accounts, where usernames and passwords are often weaker. Once an attacker controls a child’s Roblox, Fortnite, or Discord account tied to the same family address, further personal details can be extracted and sold or published.

Spacebears Ransomware Group Track Record

Public reporting attributes the attack to the spacebears ransomware group. The group emerged in recent years and has targeted organizations across multiple sectors by deploying ransomware to encrypt systems and exfiltrating data before demanding payment. Their typical playbook involves initial access through common vulnerabilities or phishing, followed by claimed exfiltration of sensitive files and publication on their leak site when victims do not pay the ransom. Notable prior victims include other small-to-medium businesses whose internal records were posted in similar fashion.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, addresses, and online handles that may have been exposed in this or earlier breaches.
• Rotate the password used at The Foot Doctor’s anywhere it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same contact details.
• Let remediation specialists handle takedown requests for any personal information already appearing on data broker or leak sites.

The reality is that medical providers and other small businesses will continue to be targeted because their security budgets lag behind the sophistication of ransomware operators. Protecting your family requires more than hoping the next breach misses you. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage explicitly includes children’s gaming accounts that frequently become the next link in a doxxing chain after a credential leak like this one.