agakam Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 28 March 2025, the association known as agakam appeared on a ransomware leak site operated by the group that calls itself qilin. The listing asserts that internal files were taken during a ransomware attack. For the physiotherapists, dentists and other independent health professionals who rely on agakam for administrative support, the practical question is straightforward: whether any of their own records, or those of their patients, now sit outside the organisation’s control.

Public detail remains limited. The number of people affected is unknown, and the precise contents of the files have not been independently confirmed. What is known is that a group specialising in double-extortion ransomware has claimed responsibility for the intrusion and the subsequent exfiltration of internal material. That claim alone is enough to warrant careful attention from anyone whose professional or personal data may have passed through agakam’s systems.

Inside the incident

According to the available record, agakam was listed by the qilin ransomware group on 28 March 2025. The group states that internal files were exfiltrated as part of a ransomware attack. No further technical details—such as the initial access vector, the duration of the intrusion, the volume of data removed, or any ransom demand—have been disclosed in the public summary. The number of individuals whose information may be involved is likewise unreported.

Ransomware incidents of this type typically involve encryption of systems combined with theft of data, after which the operators threaten to publish or sell the material if payment is not made. In this case the only concrete assertion on record is the leak-site listing itself. Until independent verification or an official statement from agakam appears, the scale and exact method of the incident remain unconfirmed.

The group behind it: qilin

Qilin is a ransomware operation that has been active for several years and functions largely as a ransomware-as-a-service model. Affiliates gain access to victim networks, deploy the encryptor, and exfiltrate data; the core group then manages negotiations and leak-site publication. The group is known for double-extortion tactics: encrypting systems while simultaneously stealing files so that victims face both operational disruption and the threat of public exposure.

Public reporting on qilin has documented attacks across multiple sectors, including healthcare-adjacent organisations, manufacturing and professional services. The group maintains a dedicated leak site on which it posts victim names and, in some cases, sample files. Listings are claims made by the operators; they do not constitute independent confirmation that every asserted detail is accurate. In the present case the facts state only that agakam was listed and that internal files were said to have been exfiltrated. No additional statements attributed specifically to this victim have been recorded beyond that listing.

agakam and its sector

Agakam is described as an association that supplies management services to physiotherapists, dentists and other liberal professions. Its stated purpose is to ease the administrative and operational burden on healthcare professionals so they can concentrate on clinical work. Organisations of this kind commonly handle billing, scheduling, regulatory compliance paperwork, payroll for small practices, and sometimes shared patient-related administrative data.

Because agakam sits at the intersection of healthcare delivery and back-office support, a compromise can affect not only the association’s own staff but also the independent practitioners who outsource functions to it and, indirectly, the patients those practitioners serve. In many jurisdictions, health-related administrative data is subject to strict confidentiality rules. Even when clinical records themselves are not held centrally, the supporting files—contracts, invoices, identity documents, contact lists—can still contain sensitive personal and professional information. A breach at this layer therefore carries consequences that extend beyond a single corporate network.

The information in question

The public record names the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of file types, no count of records, and no confirmation of whether patient data, employee data or purely operational documents were involved has been released. Organisations that provide management services to liberal health professions typically hold a range of material: practitioner registration details, bank and tax information, correspondence with regulators, appointment or billing databases, and internal policy documents. Whether any of those categories were among the files taken remains unconfirmed.

Until agakam or an independent investigator publishes a clearer description, it is not possible to state with certainty what specific data left the organisation’s control. The prudent working assumption for anyone connected to agakam is that internal administrative material may have been copied; anything beyond that is speculation.

What's at stake

For individual practitioners the immediate risks are identity misuse, financial fraud and reputational harm if contracts, tax identifiers or professional credentials appear in the wild. Patients whose administrative details were processed through agakam could face targeted phishing or social-engineering attempts that reference genuine appointments or invoices. The association itself faces operational disruption, potential regulatory scrutiny and the longer-term cost of restoring trust among the professionals it serves.

Because the number of people affected is unknown and the exact data types remain undisclosed, the full scope of harm cannot yet be measured. What can be said is that any organisation handling health-adjacent administrative records holds information that is both personally sensitive and commercially valuable to criminals. The combination of ransomware encryption and data theft raises the dual possibility of temporary service interruption and lasting exposure of confidential material.

If your data was in this claimed breach

If you are a practitioner who uses agakam’s services, or if you believe your personal or professional details may have been processed by the association, a small number of concrete steps reduce further risk:

• Monitor bank and credit accounts for unexpected activity and enable transaction alerts where available.
• Treat any unexpected email, text or phone call that references agakam, your practice or recent invoices with caution; verify through a known official channel before responding or clicking links.
• Change passwords on any accounts that may have shared credentials or recovery information with systems used by agakam, and enable multi-factor authentication wherever possible.
• Request a formal notification or status update from agakam if you have not already received one, so you know what, if anything, the organisation has confirmed about your data.
• Consider placing a fraud alert with credit-reference agencies if you hold financial identifiers that could have been among the internal files.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets. Such a scan does not confirm or rule out involvement in this specific incident, but it can reveal whether the same address has surfaced elsewhere and therefore whether additional monitoring is warranted. Public detail on the agakam listing remains limited; staying alert to official updates from the organisation itself is the most reliable way to learn whether further protective measures become necessary.

AICompiled with AI assistance from public sources and published under our editorial standards.