Advantage Direct Care Listed by onyx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 29, 2022, Advantage Direct Care appeared on a leak site operated by the ransomware group onyx. The listing indicates that internal files were taken during a ransomware intrusion, though the number of individuals affected and the precise contents of the data remain undisclosed.

The incident follows a pattern in which ransomware operators publish victim names and samples of stolen material to increase pressure for payment. Public records do not confirm whether the organization paid a ransom or whether any of the claimed data has been published elsewhere.

What happened

Advantage Direct Care was listed on the onyx ransomware leak site on April 29, 2022. The group claims to have exfiltrated internal files during a ransomware attack. No further details on the timing of the intrusion, the volume of data taken, or the method of initial access have been made public.

The number of people whose information may be involved is not stated in available reports. It is also not confirmed whether the listed files were later released or whether the organization acknowledged the incident.

Who is onyx?

Onyx is a ransomware group that maintains a public leak site to display names of organizations it claims to have compromised. Like other double-extortion operators, the group typically encrypts systems and removes copies of data, then uses the threat of publication to encourage payment.

The group has appeared in multiple public listings involving healthcare and service organizations. Its listings constitute claims by the actor; independent verification of the data or the circumstances of each intrusion is not provided by the group.

About Advantage Direct Care

Advantage Direct Care operates in the direct-care sector, providing medical and support services that involve routine collection of patient and employee information. Organizations of this type commonly store clinical records, insurance details, identification documents, and internal administrative files.

A breach at such an entity is consequential because the data held is often sensitive and subject to regulatory protections. Even limited exposure of internal files can affect ongoing care coordination and administrative functions.

What was likely exposed

The only information released about the contents is that internal files were allegedly exfiltrated. The specific categories of data within those files have not been disclosed.

Organizations in this sector typically hold patient identifiers, medical histories, billing records, and staff documentation. Whether any of these categories were present in the claimed exfiltration cannot be confirmed from public information.

Why it matters

Exposure of internal files from a care provider can lead to misuse of personal identifiers or health information, increasing risks of fraud or targeted scams for affected individuals. For the organization, the incident may require extended investigation, notification obligations, and operational adjustments.

Because the scale and exact nature of the data remain unknown, the full scope of potential impact cannot yet be measured.

If your data was in this claimed breach

Monitor accounts for unusual activity and consider placing fraud alerts with credit bureaus if identification or financial details appear to be involved. Review any communications from Advantage Direct Care for official guidance.

Individuals can run a free exposure scan of their email address against known breach data to check for prior appearances of their information in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.