Contact Cottrell and McCullough Listed by alphv Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have been patients or contacts of Contact Cottrell and McCullough face a practical concern: internal files from the clinic were reportedly taken in a ransomware attack and later described as publicly available. When a dental practice is involved, the stakes centre on ordinary personal and clinical details that can be misused for fraud, unwanted contact, or further social engineering. Public detail remains limited, yet the listing alone is enough reason for affected individuals to treat the matter seriously and check their own exposure.

On 2 November 2023 the organisation was named on a leak site associated with the alphv ransomware group. The number of people affected is unknown, and the precise contents of the files have not been independently itemised beyond the description of internal material and patient-related data. What follows sets out only what has been reported, places the claim in context, and outlines concrete steps readers can take.

Breaking down the breach

According to the available record, Contact Cottrell and McCullough was listed by the alphv ransomware group on 2 November 2023. The reported summary states that the clinic’s patient data became publicly available as a result of a hacker attack, and the data types named are internal files exfiltrated in a ransomware attack. No confirmed figure for the number of individuals affected has been published. Timing of the initial intrusion, the exact technical method used, and any ransom demand or payment status are undisclosed in the public facts. The leak-site listing itself constitutes a claim by the group rather than an independently verified confirmation of every asserted detail.

In short, the incident is characterised as a ransomware event involving exfiltration of internal files, with subsequent public availability of material linked to the clinic’s patient data. Beyond that framing, granular forensic or operational particulars remain unconfirmed.

Who is alphv?

Alphv, also widely known in public reporting as BlackCat, is a ransomware operation that has functioned on a ransomware-as-a-service model. Affiliates gain access to victim networks, deploy the encryptor, and exfiltrate data before encryption in a double-extortion pattern: the group threatens both operational disruption and public release of stolen files if payment is not made. The group has historically maintained a dark-web leak site on which it names organisations and, in many cases, posts samples or larger archives of claimed data. Public documentation of alphv activity spans multiple sectors and geographies; the group has been noted for using customisable ransomware written in Rust and for relatively professional negotiation and leak-site practices. None of that general background proves the specific claims made about any single victim. In this instance, alphv’s listing of Contact Cottrell and McCullough should be read as the group’s assertion that it holds and has released or will release material from the organisation.

Who is Contact Cottrell and McCullough?

Contact Cottrell and McCullough is identified in the reporting as a clinic associated with dental services (referenced in connection with cottrell-dental patient data). Dental and similar outpatient clinical practices typically maintain appointment systems, treatment records, billing information, insurance details, and basic identity data for patients and sometimes staff or referring providers. A breach at such an organisation is consequential because the data are both personal and health-related; even limited clinical or administrative files can enable identity misuse or targeted phishing that appears credible because it references real appointments or treatments. The organisation’s size, exact locations, and internal security posture are not detailed in the public breach facts, so no further characterisation is offered here.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack and state that the clinic’s patient data became publicly available. No exhaustive inventory of fields—such as specific identity documents, clinical notes, financial account numbers, or the total volume of records—has been supplied in the given record. Organisations of this kind ordinarily hold names, contact details, dates of birth, insurance or payment information, treatment histories, and appointment records. Because the exact contents remain unconfirmed beyond the high-level description, it is not possible to state with certainty which of those typical categories were present in the taken files. Readers should therefore assume a cautious posture without treating any particular data element as verified fact.

The real-world impact

For individuals, the principal risks are straightforward. Stolen patient or administrative data can be used to attempt identity fraud, to craft convincing phishing or vishing messages that reference real clinical relationships, or to support broader credential-stuffing and account-takeover attempts if email addresses or other login-related details were included. Health-related information, even when limited, can feel especially sensitive and may cause lasting unease. For the organisation, consequences can include regulatory notification duties, potential civil exposure, operational disruption from the ransomware event itself, and the longer-term cost of investigation, remediation, and patient communication. None of these outcomes is inevitable in every case, and the absence of a published count of affected people means the scale of individual harm cannot be quantified from the public record alone. The prudent course is to treat the reported availability of internal and patient-linked files as a credible warning rather than as proof of any specific secondary crime.

Were you affected?

If you have been a patient, employee, or regular contact of Contact Cottrell and McCullough, consider the following practical steps:

• Monitor financial and insurance statements for unfamiliar activity and consider a fraud alert with major credit reporting services if you believe sensitive identity data may have been involved.
• Treat unsolicited calls, emails, or messages that reference the clinic or your treatment history with caution; verify through official channels before sharing further information or clicking links.
• Change passwords on related accounts, especially if you reused credentials, and enable multi-factor authentication where available.
• Retain any breach notification you receive from the organisation and follow its guidance on protective measures or credit monitoring offers.
• Run a free exposure scan of your email addresses to check whether they have already appeared in known breach datasets; this does not confirm involvement in this specific incident but can surface other exposed credentials that deserve immediate attention.

Public detail on this incident is limited to the alphv listing, the 2 November 2023 reporting date, the description of internal-file exfiltration, and the statement that patient data became publicly available. No independent confirmation of file contents or affected-person counts is contained in the facts. Staying alert to unusual account activity and verifying communications remain the most useful immediate responses.

AICompiled with AI assistance from public sources and published under our editorial standards.