visufarma.com Listed by INC Ransom Ransomware Group

Visufarma, the European ophthalmology products company formed in 2016 from the merger of Visufarma SpA and Nicox SA activities, was listed on the Incransom ransomware leak site on November 14, 2024. The extortion group claims to have exfiltrated 200 GB of internal files during a ransomware attack on the company’s systems. Anyone whose personal or medical information passed through Visufarma’s network — patients, employees, suppliers, or partners — may now face heightened risk of identity theft and doxxing.

Reported Details from the Listing

The Incransom leak-site posting states that the actor successfully compromised visufarma.com and extracted internal files. It lists a claimed volume of 200 GB of data and references an additional figure of 50 million records, though the disclosure does not specify whether this represents distinct individuals or total data entries. The listing does not detail the exact file types or categories of information taken. Publicly available company information confirms Visufarma maintains portfolios covering dry eye, eyelid hygiene, meibomian gland dysfunction, retinal health, food supplements, and glaucoma treatments across European markets.

The primary disclosure indicates the data was obtained through a ransomware attack and is now published as part of an extortion campaign. No ransom demand amount or payment deadline appears in the initial public listing.

Why This Matters for You and Your Family

When a healthcare-adjacent company like Visufarma suffers a breach, the consequences reach far beyond corporate embarrassment. Medical-product suppliers routinely handle names, contact details, prescription histories, insurance information, and sometimes payment records for patients and medical professionals. Even if the leak-site listing does not quantify affected records, the 200 GB volume suggests a substantial cache of sensitive business and personal data is now in criminal hands.

For ordinary families this translates into concrete risks: unexpected phishing emails that reference your eye-care history, fraudulent insurance claims filed in your name, or targeted scams pretending to come from a supplier you actually use. Children’s data, if linked through family accounts or parental medical purchases, can also be swept up and later sold on underground forums.

Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at publishing one compressed archive. Once initial data appears, attackers and opportunistic criminals begin mapping relationships between emails, phone numbers, employee names, and customer records. These identity chains quickly expand to link professional details with personal social-media handles, children’s gaming accounts, and home addresses. A single leaked pharmacy-supplier record can become the anchor for long-term harassment or financial fraud.

Credential leaks like this one cascade into account takeovers across unrelated services where the same password or email was reused. Gaming platforms are especially vulnerable because children and teens often inherit family email addresses or phone numbers, turning one corporate breach into a household-wide exposure vector.

Incransom’s Known Track Record

Public reporting attributes Incransom with emerging in early 2024 as a double-extortion operation that combines data theft with encryption. The group typically gains initial access through phishing, remote-desktop protocol weaknesses, or compromised vendor credentials before exfiltrating large document repositories. After encryption, Incransom follows a standard playbook: publish samples on its dark-web blog, demand payment, then threaten to release the full dataset or sell it to other criminals if the victim does not pay.

Previous victims listed by the group have included mid-sized manufacturing, logistics, and healthcare-adjacent firms, many of which lacked robust segmentation between operational networks and customer databases. The group’s leak site remains active and continues to update deadlines and proof-of-compromise samples on a regular basis.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, and real-world identity that may have been exposed in the Visufarma incident.
• Rotate any password you used at visufarma.com or related supplier portals anywhere it has been reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted upon within hours.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts which often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests and data-broker suppression for you instead of attempting manual removal across dozens of sites.

The Visufarma listing is a reminder that healthcare-supply-chain breaches now expose ordinary families as readily as large hospitals. Acting quickly on credential hygiene and identity mapping can break the chain before criminals turn stolen files into long-term harassment or financial loss. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.