AiHealth Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
AiHealth was listed by thegentlemen ransomware group on November 24, 2025, after internal files were exfiltrated. Individuals whose data may be involved should review any notices from AiHealth and take standard protective steps.
Inside the incident
On 24 November 2025 the ransomware group thegentlemen listed AiHealth on its leak site. The listing states that internal files were exfiltrated during a ransomware attack. No figure for the number of people affected has been released, and no further technical details about the intrusion method or timeline have been made public.
The group behind it: thegentlemen
Thegentlemen is a ransomware operation that publicly lists victim organisations on a dedicated site after encrypting systems and removing data. The group’s pattern involves claiming data theft and threatening publication unless demands are met. Its listing of AiHealth constitutes an unverified claim by the actor; independent confirmation of the incident has not been provided in the available facts.
About AiHealth
AiHealth operates an online platform that connects users with doctors, supports appointment booking, medication purchases, health check-up programmes and home nursing services. Organisations in this sector routinely process appointment records, prescription information and contact details for individuals seeking medical care.
The information in question
The only data category named in the listing is “internal files exfiltrated in ransomware attack.” The precise contents of those files have not been disclosed. Organisations of this type commonly hold patient identifiers, medical histories, appointment logs and payment information, yet the exact nature of the material allegedly taken from AiHealth remains unconfirmed.
Why it matters
Healthcare platforms hold records that can be used for identity theft, targeted fraud or unwanted disclosure of sensitive personal circumstances. When files are removed during a ransomware event, the risk extends beyond immediate operational disruption to longer-term misuse of whatever data the files contain. The absence of a confirmed count of affected individuals leaves the full scope of potential impact open.
What to do if you're exposed
Individuals can begin by monitoring their email accounts and financial statements for unusual activity. A short list of immediate steps includes:
- Change passwords for any AiHealth-related accounts and enable multi-factor authentication where available.
- Review bank and insurance statements for unauthorised transactions.
- Run a free exposure scan of your email address against known breach data to check for additional appearances.
Organisations in similar sectors are advised to review access logs and confirm whether any patient communications have been affected.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Devereux Advanced Behavioral Health Listed by thegentlemen Ransomware GroupNatren Listed by thegentlemen Ransomware GroupAthens Orthopedic Clinic Claimed by TheGentlemen RansomwareSouth Texas Spinal Clinic Listed by thegentlemen Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the AiHealth Listed by thegentlemen Ransomware Group →
Publicly posted by thegentlemen — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.