zHealthEHR — Practice Management Software for Chiropractic & Wellness Clinics Listed by kazu Ransomware Group

On January 26, 2026, the zHealthEHR platform appeared on the leak site of the kazu ransomware group. The company provides cloud-based electronic health records and practice management software used by chiropractors and wellness clinics across the United States. Internal files were allegedly exfiltrated during a ransomware attack, exposing data that belongs to the clinics, their staff, and ultimately the patients whose records live inside the system.

What's Publicly Reported from Reporting

Public reporting indicates that kazu listed zHealthEHR on its leak site and claimed to have stolen internal files. The platform handles clinical documentation, appointment scheduling, patient intake forms, billing records, payment details, and automated patient reminders. Because zHealthEHR operates on a subscription model for small to mid-size practices, the stolen data likely includes both business documents and sensitive patient health information. Exact victim counts and the full volume of records remain unconfirmed, but the presence of the company on a ransomware leak site states that attackers successfully accessed and removed data.

Why This Matters for You and Your Family

If you or anyone in your family sees a chiropractor, physical therapist, or wellness provider who uses zHealthEHR, your personal health details, contact information, and possibly payment records may now sit in an attacker’s hands. Health data is especially damaging when leaked because it can be used for insurance fraud, identity theft, or targeted scams that reference your medical history. Even if you never signed up for the service yourself, the clinic’s breach puts your information at risk. Families often share the same providers, which means one incident can quietly expose parents, children, and grandparents at the same time.

The Doxxing and Identity-Chain Implications

Health records rarely exist in isolation. They frequently contain email addresses, phone numbers, home addresses, dates of birth, and insurance IDs. Attackers combine these details with information from other breaches to build detailed profiles. A single leaked patient intake form can link your clinical notes to your social-media handles, children’s school records, or gaming usernames. Once those connections are made, harassment, blackmail, or account takeovers become far easier. Credential leaks like this one routinely cascade into gaming account compromises, especially for families where children use the same email address or password patterns across apps and websites.

Kazu Ransomware Group Track Record

Public reporting attributes the attack to the kazu ransomware group. The group emerged in recent years and has targeted organizations in the healthcare and small-business sectors. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by data exfiltration before encryption. Kazu then demands payment and, if unpaid, publishes samples or full datasets on its leak site to pressure victims. Notable prior incidents involve other medical and administrative platforms, though exact details remain limited in open sources.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to the zHealthEHR breach.
• Rotate any password you used at your clinic or anywhere else the same credentials appear, then enable two-factor authentication through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become the next link in doxxing chains after health data leaks.
• Let remediation specialists handle takedown requests for any exposed personal records that surface on data broker sites or underground forums.

The zHealthEHR incident shows how quickly a single clinic’s software provider can place thousands of families in the crosshairs. Acting promptly limits what attackers can build from the stolen files. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for you and your entire household, including children’s gaming accounts that frequently get swept into these cascades. Start your DoxxScan trial today and close the gaps before the next breach compounds this one.