CHRISTUS Health Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 26, 2022, CHRISTUS Health was listed by the AvosLocker ransomware group, which claimed to have carried out a ransomware attack involving the exfiltration of internal files. Public detail remains limited: the number of people affected is unknown, and no further confirmed technical specifics have been widely documented beyond the group's listing itself.

For patients, employees, and partners of a major health system, any such claim raises immediate questions about the security of sensitive operational and personal information. What is known so far rests on the reported listing and the description of internal files taken during the attack; independent verification of the full scope has not been detailed in the available record.

What happened

According to the reported information, CHRISTUS Health appeared on an AvosLocker-associated listing dated December 26, 2022. The group claimed responsibility for a ransomware attack in which internal files were exfiltrated. No public figure has been given for the number of individuals affected, and details such as the precise intrusion method, duration of unauthorized access, or whether systems were encrypted in addition to data theft remain undisclosed in the available facts. The incident is therefore characterized by the group's claim of file exfiltration rather than by a fully corroborated public accounting of every technical element.

Who is avoslocker?

AvosLocker is a ransomware operation that became known in the early 2020s for running a ransomware-as-a-service model and practicing double extortion. In that model, operators encrypt victim systems and also steal data, then threaten to publish the stolen material on a dedicated leak site if payment demands are not met. The group typically listed claimed victims publicly to increase pressure. Its activity was documented across multiple sectors, including healthcare and other organizations holding valuable operational or personal data. With respect to CHRISTUS Health specifically, the available record shows only that the group listed the organization and claimed internal files had been exfiltrated; no additional statements or proof packages unique to this victim are detailed in the facts provided. Such listings should be treated as claims unless independently confirmed.

CHRISTUS Health and its sector

CHRISTUS Health is an international Catholic, faith-based, not-for-profit health system founded in 1999 and headquartered in the Dallas area. Like other large health systems, it operates hospitals, clinics, and related care facilities and therefore handles substantial volumes of clinical, administrative, and operational information. Healthcare organizations are frequent targets for ransomware groups because disruption of care delivery creates urgency and because the data they hold—ranging from patient records to internal business files—can be leveraged for extortion or further misuse. A claimed breach at an entity of this type is consequential precisely because continuity of care and the confidentiality of health-related information are central to its mission and to public trust.

The information in question

The facts state that internal files were exfiltrated in the ransomware attack. No more granular inventory—such as specific categories of patient data, employee records, financial documents, or system credentials—has been named in the provided record. Organizations of this kind typically maintain electronic health records, billing and insurance information, staff personal data, vendor contracts, and internal operational documents. Because the exact contents taken in this incident are unconfirmed beyond the description “internal files,” it is not possible to state with certainty which of those typical holdings, if any, were involved. Readers should regard the exposed material as described only at that general level until further official detail appears.

Why it matters

When internal files from a health system are claimed to have been stolen, the practical risks include potential misuse of any personal or clinical information that may have been among those files, targeted phishing or social-engineering attempts that reference the organization, and operational disruption if systems were also affected by ransomware. For individuals, even limited exposure can lead to identity-related fraud or unwanted contact. For the organization, consequences can include regulatory scrutiny, notification obligations, remediation costs, and erosion of confidence among patients and partners. Because the scale of affected people remains unknown and the precise data types are not fully itemized, the concrete impact on any single person cannot be stated from the public facts alone; the prudent stance is to treat the claim seriously and monitor for signs of misuse.

What to do if you're exposed

If you have a relationship with CHRISTUS Health as a patient, employee, or partner, consider practical steps: monitor financial and insurance statements for unfamiliar activity, be cautious of unsolicited messages that reference the health system or urge urgent action, and place fraud alerts or credit freezes if you believe sensitive identifiers may have been involved. Retain any official notices the organization may issue. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets, which can help you decide what further monitoring is warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.