Circles of Care Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 20 September 2022, Circles of Care appeared on a listing associated with the alphv ransomware group. Public detail remains limited: the number of people affected is unknown, and the only description of what was taken refers to internal files said to have been exfiltrated in a ransomware attack. For anyone who has received care, worked with, or shared personal information with a behavioral healthcare provider, that kind of claim raises immediate practical questions about what may now be outside the organisation’s control and who might try to misuse it.

Healthcare and behavioral-health organisations routinely hold sensitive records. When a ransomware group claims to have copied internal material, the stakes are not abstract. They involve real people whose medical, personal, or administrative data could be exposed, sold, or used for fraud or social engineering. This article sets out only what has been reported, places the claim in context, and outlines sensible next steps.

Breaking down the breach

According to available reporting, Circles of Care was listed by the alphv ransomware group on or around 20 September 2022. The listing characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No public figure has been given for the number of individuals affected. No detailed inventory of file types, systems, or time window has been released in the material provided. Method of initial access, duration of presence on networks, and whether encryption was also deployed are undisclosed.

In short, the public record at the time of the report consists of a group claim that Circles of Care was a victim and that internal files were taken. Independent confirmation of the full scope, the precise contents, or the operational timeline is not part of the disclosed facts. Readers should treat the listing as an unverified claim by the threat actor unless and until the organisation or regulators provide further verified detail.

The group behind it: alphv

alphv, also widely known in public reporting as BlackCat, is a ransomware operation that emerged in the early 2020s and has been documented across numerous incidents. The group has typically operated a ransomware-as-a-service model, in which affiliates conduct intrusions and deploy the group’s encryptor and leak infrastructure in exchange for a share of proceeds. Public analyses have described alphv affiliates using common initial-access paths such as compromised credentials, vulnerable internet-facing services, and phishing, followed by lateral movement, data theft, and encryption.

A hallmark of alphv’s public posture has been the use of a leak site on which victims are named and, in many cases, samples or larger sets of stolen data are threatened or published if a ransom is not paid. The group has been linked in open-source reporting to attacks across healthcare, manufacturing, government contractors, and other sectors. None of that general history, however, proves the specific contents or impact of any single listing. For Circles of Care, the facts state only that the organisation was listed and that internal files were described as exfiltrated; they do not include verified quotes, ransom demands, or published file samples tied to this victim beyond that claim.

Circles of Care and its sector

Circles of Care is described in the reported summary as a provider of behavioral healthcare services, with language emphasising comprehensive, high-quality care. Organisations of this type typically deliver mental-health, substance-use, and related clinical and support services. They sit inside a regulated healthcare environment in which patient privacy, clinical documentation, and continuity of care are central obligations.

Behavioral healthcare providers commonly maintain electronic health records, intake and assessment forms, treatment plans, billing and insurance information, staff records, and operational documents. A breach claim against such an organisation is consequential because the data involved is often highly sensitive, long-lived, and useful to criminals for identity theft, insurance fraud, targeted phishing, or blackmail. Even when the exact contents of a claimed exfiltration remain unconfirmed, the sector context explains why patients, families, and staff have reason to pay attention.

The information in question

The facts name the exposed material only as “internal files exfiltrated in [a] ransomware attack.” No further breakdown—such as whether clinical records, employee data, financial files, or administrative documents were included—is provided. The number of people affected is listed as unknown.

Organisations that deliver behavioral healthcare typically hold names, dates of birth, contact details, Social Security or insurance identifiers, clinical notes, diagnoses, medication histories, appointment records, and billing data, along with internal business files. That is the general pattern for the sector; it is not a confirmed inventory of what alphv claims to have taken from Circles of Care. Exact contents in this incident remain unconfirmed. Anyone who has been a patient, employee, or business partner should assume that sensitive categories of information could theoretically be involved until the organisation states otherwise with specificity.

What's at stake

For individuals, the practical risks include fraudulent use of identity or insurance information, unwanted contact or social-engineering attempts that reference real clinical or personal details, and long-term exposure of private health matters. Behavioral-health data can be especially damaging if it surfaces in criminal markets or is used to pressure or embarrass someone. Monitoring financial accounts, insurance statements, and unexpected communications is a concrete response rather than a theoretical one.

For the organisation, a claimed ransomware incident with data exfiltration raises operational, regulatory, and trust issues. Healthcare entities may face notification duties, potential investigations, remediation costs, and the need to support affected people. Continuity of care can also be disrupted if systems are locked or if staff must divert time to incident response. None of these outcomes is asserted here as proven fact for Circles of Care; they are the ordinary consequences that follow when such claims are made against providers in this sector.

Were you affected?

If you have a past or present relationship with Circles of Care as a patient, family member, employee, or contractor, treat the September 2022 listing as a reason to be watchful rather than as proof that your specific records were taken. Watch for unfamiliar medical bills, insurance notices, or messages that appear to reference your care. Consider placing fraud alerts with major credit bureaus if you have reason to believe identity data may be involved, and be cautious of unsolicited calls or emails seeking verification of personal or clinical details.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not confirm or deny involvement in this specific incident, but it can surface other exposures and help you prioritise password changes and monitoring. If Circles of Care or a regulator later issues formal notices, follow the instructions in those communications promptly.

AICompiled with AI assistance from public sources and published under our editorial standards.