Washington Gastroenterology (DHSWA.NET) Listed by incransom Ransomware Group

On January 17, 2025, the incransom ransomware group added Washington Gastroenterology to its leak site, claiming that internal files had been exfiltrated from the large Washington state medical practice.

What's Publicly Reported from Reporting

Washington Gastroenterology, also known as WAGI or DHSWA.NET, resulted from the 2018 merger of three established practices: Digestive Health Specialists in the Tacoma area, Northwest Gastroenterology Associates, and Overlake Internal Medicine Associates – Gastroenterology in the Bellevue region. The organization provides care across western Washington and maintains patient records, billing data, and operational files that would be valuable in a breach.

Public reporting indicates the group claims to have stolen internal files during a ransomware incident. The exact number of affected patients remains unknown, and the specific types of data exposed have not been detailed beyond the broad description of internal files. The listing appeared on the incransom leak site on January 17, 2025, following the group’s standard practice of publishing proof of exfiltration when victims do not meet payment demands.

Why This Matters for You and Your Family

If you or any member of your family has received care from Washington Gastroenterology since its formation in 2018, your personal health information, insurance details, Social Security numbers, or contact data may now sit in an attacker’s archive. Medical records are especially sensitive because they contain lifelong health history that cannot be changed like a password. Once exposed, this information can be sold, used for identity theft, or combined with other leaks to build a complete profile of you and your household.

Health data and personal identifiers from a single breach often surface months or years later in unexpected places, from fraudulent tax filings to targeted scams that reference your medical conditions. For families, one parent’s visit can expose children’s records if they share the same insurance policy or address.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at the initial data set. Attackers or buyers frequently cross-reference stolen emails, usernames, and phone numbers against other breaches. This creates an identity chain that links your medical records to gaming accounts, social media handles, and family member profiles. A child’s Roblox or Minecraft username reused with the same password as a parent’s medical portal login can quickly lead to account takeovers, harassment, or physical doxxing.

Credential leaks like this one cascade into gaming account compromises because children often share family email addresses or phone numbers. Once an attacker controls one account in the chain, they can reset others and gather more personal details, accelerating the spread of your family’s information across underground forums.

Incransom Group Track Record

Public reporting attributes the attacks to the incransom ransomware group. The group emerged in recent years and follows a double-extortion playbook: it encrypts victim systems, exfiltrates data before encryption completes, then demands payment to prevent publication. Notable prior victims include other healthcare providers and mid-sized organizations whose internal files were posted on the same leak site after deadlines passed. The group typically gives victims a short window to negotiate before releasing samples and eventually the full archive.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what this claimed breach connects to.
• Rotate the password you used at Washington Gastroenterology anywhere else it appears, then enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same addresses and emails stolen in medical breaches.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate or chase them yourself.

The incident shows that even established medical practices can become targets, and the data they hold travels farther and lasts longer than most people expect. Taking concrete steps now limits how far this claimed breach can follow you or your children. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly protects children’s gaming accounts alongside adult identities.