VirMedice Listed by pear Ransomware Group

On September 11, 2025, healthcare software provider VirMedice appeared on the leak site of the pear ransomware group. The company, which supplies NextGen Ambulatory EHR and NextGen Ambulatory PM systems to medical practices, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of patients and staff whose records may be affected remains unknown, anyone whose healthcare provider uses these platforms could have personal health information now at risk.

Reported Details of the Incident

Public reporting indicates that VirMedice was listed on the pear ransomware group’s leak site on September 11, 2025. The data exposed consists of internal files exfiltrated after the attackers gained access to the company’s systems. VirMedice provides electronic health records and practice management software used by ambulatory care providers across the United States. No confirmed patient count has been released, and the precise volume or sensitivity of the stolen files has not been publicly detailed beyond the broad description of internal documents.

Why This Matters for You and Your Family

When a healthcare software vendor is breached, the ripple effects reach ordinary patients and their families. Medical records often contain names, dates of birth, Social Security numbers, addresses, insurance details, and clinical information. Once this data leaves the controlled environment of a doctor’s office, it can be sold, combined with other leaks, or used to commit identity theft, insurance fraud, or even blackmail. For many families, a single health record breach can create years of paperwork, credit monitoring, and worry. The fact that the breach involves software used by multiple practices means one incident can quietly expose thousands of unrelated households at once.

The Doxxing and Identity-Chain Risks

Health data rarely travels alone. Attackers frequently cross-reference leaked medical files with credentials from earlier breaches, social media handles, and gaming accounts. A doctor’s note listing your child’s name and birthdate can be paired with an email address found in another breach, then linked to a Roblox or Fortnite username. This creates an identity chain that leads directly to your home address and family members. Credential leaks like this one often cascade into account takeovers across email, banking, and children’s gaming platforms. The result is not just identity theft but full doxxing that can expose your family’s daily routines, locations, and vulnerabilities.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, then complete the cleanup of exposed data.
• Rotate any password you used for VirMedice-related accounts or patient portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts.

The pear group’s appearance with VirMedice data is a reminder that healthcare vendors remain high-value targets. Protecting your family now means treating every breach as a link in a larger chain rather than an isolated event. Start by understanding exactly where your information surfaces online and close those connections before criminals can exploit them. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts.