www.physicianpartnersofamerica.com Listed by dispossessor Ransomware Group

On December 1, 2022, Physician Partners of America appeared on the leak site of the Dispossessor ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the medical practice’s network. The disclosure does not quantify how many patient or employee records were affected, nor does it list the specific types of documents taken.

Details from the Leak Site

The Dispossessor leak page explicitly names Physician Partners of America and provides contact information for five executives and directors, including Omah Sang, Executive Director of Operations, Mauricio Orbegozo, Regional Director, Bonnie Guirguis, Director of Business Development, Sandra Loayza, Director, and Chris Gardner, Director. The posting states the data was obtained through a ransomware incident and warns that the files will be published if demands are not met. No sample data files or screenshots are shown in the initial listing, and the exact volume of stolen information remains unknown.

Internal files exfiltrated is the only description the group provided. The notification does not state whether electronic health records, billing information, insurance details, or employee personnel files were included.

Why This Matters for You and Your Family

If you or a family member has been treated at a Physician Partners of America clinic, your protected health information may now sit in an attacker’s archive. Medical data is especially sensitive because it can reveal chronic conditions, mental-health treatment, prescription histories, and family relationships. Once stolen, this information rarely disappears. It can be sold quietly on dark-web forums or used months later in targeted fraud schemes. Even without an exact patient count, the exposure affects anyone whose records were stored on the compromised systems.

Employees of the practice are also at risk. The published executive contact details, phone numbers, and email addresses make it easier for attackers to launch spear-phishing campaigns or identity-theft attempts against those individuals and their households.

Doxxing and Identity-Chain Risks

Medical breaches create long identity chains. A single email address or phone number published alongside internal files can be correlated with social-media accounts, children’s school records, or gaming usernames. Attackers routinely combine leaked healthcare data with credential-stuffing results to seize online accounts. When a parent’s work email is exposed, a child’s Roblox or Fortnite account that reuses the same password becomes an easy follow-on target. The result is doxxing that reaches every member of the household.

Credential leaks like this one cascade into account takeovers and doxxing chains that can affect gaming accounts belonging to you or your children. Once an attacker controls one family account, they can harvest additional personal details and sell or weaponize them.

Dispossessor’s Known Playbook

Public reporting attributes Dispossessor with emerging in late 2021 as a double-extortion operation. The group typically gains initial access through phishing or exploited remote-desktop services, exfiltrates documents before encrypting systems, then posts victim names on its leak site while threatening to release the data. Notable prior targets have included healthcare providers, manufacturers, and professional-services firms. Their standard tactic is to pressure executives by publishing contact information and sample files, then escalate by threatening to notify patients or regulators if the ransom is not paid. The group’s leak site remains active, and new victims continue to appear at irregular intervals.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by Warden specialists.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used at Physician Partners of America or related clinic portals anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests for any exposed executive or patient-related information appearing on data-broker or paste sites.

The incident shows that healthcare providers remain prime targets and that patient and employee data can surface without warning more than a year after the initial breach. Starting proactive defense now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts.