USWELLNESS.COM Listed by Clop Ransomware Group

On March 16, 2023, the ransomware group Clop added uswellness.com to its public leak site, listing the employee health and wellness portal as a victim of a ransomware attack in which internal files were allegedly exfiltrated. The disclosure indicates that data from US Wellness, which provides biometric screening and related services, was taken during the incident. The exact number of affected individuals remains unknown, as neither the leak-site listing nor any subsequent company notification has quantified the records involved.

Details from the Clop Listing

The primary disclosure on the Clop leak site states that internal files were exfiltrated from US Wellness during a ransomware attack. It does not specify the volume or exact types of data stolen beyond claiming that sensitive internal documents were taken. The listing includes a sample of the allegedly stolen material, a common tactic used by the group to pressure victims. Public reporting on Clop’s operations indicates the group typically posts proof-of-compromise samples after an initial extortion window passes without payment.

March 16, 2023 marks the first public appearance of uswellness.com on the site. The portal, which supports employee biometric screening programs, would logically contain health-related information, personally identifiable details, and corporate records, though the listing itself stops short of cataloging every category exposed.

Why This Matters for You and Your Family

If you or anyone in your household has participated in an employer-sponsored wellness program through US Wellness, your personal and health information may have been exposed. Biometric screening data often includes height, weight, blood pressure, cholesterol levels, and sometimes family medical history. When combined with names, dates of birth, addresses, or Social Security numbers, this creates a rich profile that identity thieves can exploit for years.

Even if you were not the primary employee, dependent coverage means spouses and children can also be affected. The disclosure indicates internal files were taken; without a detailed inventory from the company, it is prudent to assume that any information submitted to the portal could be in the hands of attackers.

Doxxing and Identity-Chain Risks

Health and wellness data rarely exists in isolation. A single breach like this can anchor an identity chain that links your work email, personal phone number, home address, and online usernames. Attackers routinely cross-reference stolen corporate files with credential leaks from other sources to build complete dossiers. Once your details surface on underground forums, they can be used for targeted phishing, account takeover attempts, or even physical stalking if addresses and family member names are included.

Credential leaks like this one frequently cascade into gaming account takeovers. Children’s usernames, shared family emails, or reused passwords from a parent’s wellness portal registration can give attackers entry to Roblox, Fortnite, Steam, or Discord accounts. From there, doxxing chains accelerate as gaming profiles often list real names, voice chat recordings, or linked social media.

Clop’s Known Track Record

Public reporting attributes the Clop ransomware operation to a cybercrime group that emerged in early 2019, initially deploying the Clop malware variant through large-scale phishing and exploitation of file-transfer software. The group gained particular notoriety in 2021 and 2022 for attacking managed file transfer platforms such as MOVEit, Accellion FTA, and GoAnywhere, tactics that allowed them to reach thousands of downstream organizations from a single initial compromise.

Notable prior victims publicly linked to Clop include major banks, healthcare systems, and technology suppliers. Their typical playbook involves initial access via vulnerable remote-access software or phishing, followed by data exfiltration before encryption. Rather than immediately encrypting systems, Clop often focuses on stealing sensitive files and then leverages dual extortion: demanding payment to prevent both encryption and public release of the data. When victims do not pay, the group publishes samples and maintains long-term pressure through their leak site.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours rather than months.
• Rotate any password you used at uswellness.com or related wellness portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same breached email or address.
• Let remediation specialists manage takedown requests for any exposed personal documents or health details that appear on data broker sites or underground forums.

The US Wellness breach is a reminder that even routine employee wellness programs can expose deeply personal information with lasting consequences. Staying ahead requires more than reactive checks; it demands continuous visibility and expert intervention when new leaks surface. DoxxScan by GalaxyWarden delivers that combination through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.