DANIEL C. HARRIS, O.D Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On or around June 15, 2023, the optometry practice DANIEL C. HARRIS, O.D. appeared on a listing associated with the 8base ransomware group. Public detail indicates that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and the precise contents of those files have not been publicly itemized beyond the general description of internal material.

For patients, staff, and others whose information may sit in a small healthcare practice’s systems, the practical stakes are straightforward: medical and contact data, if exposed, can be misused for fraud, targeted phishing, or long-term identity problems. Because the scale and exact data types are undisclosed, anyone connected to the practice has reason to treat the report as a prompt for caution rather than a claimed personal compromise.

Inside the incident

According to the available record, DANIEL C. HARRIS, O.D. was listed by the 8base ransomware group with a reported date of June 15, 2023. The summary states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of individuals affected, no file counts or sample sets have been detailed in the provided facts, and the method of initial access has not been disclosed. The listing itself constitutes a claim by the group; independent confirmation of the full scope is not contained in the record.

What is known is limited to the organization’s appearance on the group’s listing and the characterization of the material as internal files taken during a ransomware incident. Timing beyond the reported date, the duration of any unauthorized access, and whether encryption of systems accompanied the exfiltration are not specified in the available facts.

The group behind it: 8base

8base is a ransomware operation that has been publicly documented as using double-extortion tactics: encrypting victim systems while also copying data and threatening to publish it on a leak site if payment is not made. The group typically posts victim names and, in some cases, samples or descriptions of stolen files to increase pressure. Like other actors in this category, 8base has targeted organizations across multiple sectors, often smaller entities that may have fewer dedicated security resources.

In this instance, the group claims that DANIEL C. HARRIS, O.D. is a victim and that internal files were allegedly exfiltrated. No further statements attributed specifically to 8base about this practice—such as ransom demands, deadlines, or detailed file inventories—are present in the facts. The leak-site listing should therefore be read as an unverified claim pending additional corroboration.

Who is DANIEL C. HARRIS, O.D?

DANIEL C. HARRIS, O.D. is an optometry practice. Public biographical material associated with the practice describes Dr. Tim Harris as having received his Doctor of Optometry degree from Ferris State University College of Optometry in 1991, with clinical rotations at the Duane Waters Correctional Facility and the Battle Creek Veterans Administration Hospital focused on ocular disease. Specialty areas noted include diagnosis and treatment of glaucoma, dry eye, contact lenses, and family vision care. The practice operates in the eye-care sector and maintains a public web presence.

Optometry offices routinely handle patient demographics, insurance details, clinical notes, prescriptions, and appointment records. A breach affecting such a practice is consequential because the data is both personal and health-related, and because patients often maintain long-term relationships with a single provider, increasing the volume of historical information that may be stored.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No specific data categories—such as names, dates of birth, Social Security numbers, clinical records, or financial information—are enumerated, and the number of people affected is listed as unknown. Exact contents therefore remain unconfirmed.

Organizations of this kind typically hold patient contact information, insurance and billing data, examination notes, prescriptions, and internal administrative files. Staff records may also exist. None of these categories can be stated as confirmed exposures in this incident; they represent the ordinary data footprint of an optometry practice, not a verified inventory of what 8base obtained.

Why it matters

For individuals, the real-world risk centers on the possible misuse of personal and health-related information. Even limited internal files can enable convincing phishing messages that reference real appointments or conditions, or can support identity-fraud attempts if identifiers are present. Because health data is relatively static, exposure can create lingering vulnerability rather than a one-time event.

For the practice, a ransomware incident that includes exfiltration raises operational, regulatory, and trust concerns. Healthcare providers are expected to safeguard protected health information; an incident of this type can trigger notification duties, reputational harm, and the cost of investigation and remediation. The absence of public figures on scale does not reduce the need for careful response; it simply means the full picture is not yet visible.

If your data was in this claimed breach

If you have been a patient or employee of DANIEL C. HARRIS, O.D., treat the report as a reason to take basic protective steps while recognizing that your personal involvement is unconfirmed. Practical first actions include:

• Monitor bank, credit-card, and insurance statements for unfamiliar activity and consider a fraud alert or credit freeze through the major credit bureaus.
• Be alert to unexpected emails, texts, or calls that reference eye-care appointments, billing, or personal details; verify any such contact through a known official channel rather than replying directly.
• Change passwords for email and patient-portal accounts if you reuse credentials, and enable multi-factor authentication where available.
• Request an accounting of disclosures or breach notices from the practice if you believe you may be affected, and retain any official correspondence.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which can help you prioritize further monitoring.

Public detail on this incident remains limited. Continued attention to official notices from the practice and to your own financial and medical accounts is the most reliable next step.

AICompiled with AI assistance from public sources and published under our editorial standards.