www.drlincoln.com.br Listed by qiulong Ransomware Group
If you are a customer of www.drlincoln.com.br, here’s what is being claimed, and what it would mean for you.
www.drlincoln.com.br was listed on Qiulong's leak site. Qiulong claims to have stolen internal data. This is the group's claim, not a confirmed finding.
Editor’s note: The claims described below originate from a ransomware group’s leak-site posting and have not been independently verified by GalaxyWarden. A listing of this kind is an assertion made by the group during an extortion attempt. It is not evidence that a breach occurred, and we report it as a claim rather than as a finding.
www.drlincoln.com.br customer?
See what’s already exposed about you — free, 15sWe check your email against known public breach records and the sites that publish your address, then show you what to do about each one. We don’t hold this company’s data. No account, no card.
On April 19, 2024, the Brazilian plastic surgery clinic www.drlincoln.com.br, operated by Dr. Lincoln Graça Neto in Curitiba’s Batel neighborhood, appeared on the leak site of the qiulong ransomware group. Patients who visited the clinic for consultations, examinations, or surgical procedures now face the confirmed risk that their internal files have been exfiltrated.
Reported Details from the Listing
The qiulong leak site states that internal files were taken during a ransomware attack on the clinic. The disclosure does not quantify how many patient records were affected, nor does it list specific data types such as names, addresses, medical histories, photographs, or payment details. It simply states that exfiltrated material from drlincoln.com.br is now publicly listed. The business email contato@drlincoln.com.br and the physical address in Curitiba are also displayed alongside the samples. No ransom demand figure or payment deadline is shown in the current listing.
Why This Matters for You and Your Family
If you or any member of your family has been a patient at Dr. Lincoln’s clinic, your sensitive health and personal information may now sit in an attacker’s archive. Plastic surgery records frequently contain pre- and post-operative photographs, exact dates of procedures, financial transactions, and contact details that can be used for identity theft, insurance fraud, or targeted harassment. Because the leak site makes samples available, opportunistic criminals can begin searching the data immediately. Even if the full dataset has not yet been published, the mere confirmation of successful exfiltration changes your risk profile from theoretical to active.
Advertisement
BATECH StudioWe build it.We run it.Web apps, AI pipelines and internal tools — under your brand, not ours.Tell us what you need →
BATECH Studio and GalaxyWarden share common ownership.
The Doxxing and Identity-Chain Risk
Medical breaches like this one rarely stop at a single dataset. Attackers routinely cross-reference leaked patient emails, phone numbers, and addresses with credential-stuffing results from other breaches. A password reused from an old account can give them access to your email, which then reveals social-media handles, children’s names, and gaming usernames. Once those links are established, full doxxing chains form quickly. Public records, property deeds, and family photographs become easy to locate. For families with teenagers who maintain gaming accounts tied to the same email domain or phone number used at the clinic, the exposure can cascade into account takeovers and real-world stalking.
qiulong Ransomware Group Track Record
Public reporting attributes the emergence of qiulong to late 2023. The group has targeted mid-sized organizations across Latin America and parts of Europe, focusing on healthcare providers, professional service firms, and small manufacturers. Their typical playbook begins with phishing or exploitation of remote-desktop services for initial access, followed by rapid lateral movement to exfiltrate documents before deploying ransomware. Rather than noisy encryption of entire networks, qiulong often prefers quiet data theft and selective publication on their leak site to pressure victims into payment. The Dr. Lincoln listing fits this pattern: a healthcare-adjacent business with patient photographs and records that carry high personal sensitivity.
What to do
- Run a DoxxScan to map every link between your email, phone number, handles, and real identity so you can see exactly what chains back to the clinic breach.
- Rotate any password you ever used at drlincoln.com.br or with Dr. Lincoln Graça Neto, then enable 2FA through an authenticator app on every account where that password was reused.
- Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught and acted on within hours rather than months.
- Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often share the same contact details used for medical appointments.
- Let DoxxScan remediation specialists handle data-broker takedown requests and removal of any exposed personal documents on your behalf.
The incident underscores a hard reality: once health-related files leave a clinic’s control, you cannot rely on the provider to protect you. A single breach can feed an identity chain that grows for years. Start your DoxxScan trial today and put continuous monitoring, identity-chain mapping, and specialist remediation between your family and the next attacker who obtains your data. DoxxScan is also effective for protecting gaming accounts because credential leaks like this one frequently cascade into account takeovers and doxxing chains.
What the free scan actually returns
Found on people-search siteswe remove these
These listings are live, public, and legal to remove — and removing them is what we do.
Found in breach recordsverifiedreported — unverified
Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.
Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.
For security and vendor-risk teams: a staff address in a leak does not mean you were breached — it usually means a third party was. We monitor a domain against 13.1B+ leaked records and tell you when one of your people appears. See what we would check →
Report details & sourcing
Related breaches
Integrated Health Systems Listed by coinbasecartel Ransomware Group
Integrated Health Systems was listed on the coinbasecartel ransomware leak site. The group claims to…
avkvalves.com Listed by settra Ransomware Group
Investigation: Belgicast Internacional S.L. Executive Summary An analysis of more than 10,000 intern…
Kessler Creative Listed by coinbasecartel Ransomware Group
Kessler Creative was listed on the coinbasecartel ransomware leak site. The group claims to have sto…