Dermatology Associates Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Patients and staff connected to Dermatology Associates may now face uncertainty about whether personal or clinical information has left the organisation’s control. On September 19, 2025, the clinic was listed by the ransomware group known as anubis, which claims to have exfiltrated internal files and leaked clinic customer data. The number of people affected remains unknown, and public detail on the precise contents is limited, yet any exposure of medical or identifying records carries lasting practical risks for those involved.

This report sets out only what is known from the available record, places the claim in context, and outlines the concrete steps people can take while further facts are confirmed.

What happened

According to the reported summary, Dermatology Associates was listed by the anubis ransomware group on September 19, 2025. The group claims that internal files were exfiltrated during a ransomware attack and that clinic customer data has been leaked. No confirmed figure for the number of people affected has been published, and the precise method of initial access, the duration of any intrusion, and the full volume of material taken remain undisclosed. Public information is limited to the leak-site listing itself and the characterisation of the material as internal files and clinic customer data. Whether the organisation has verified the claim, paid any ransom, or recovered systems is not stated in the available record.

Inside anubis

Anubis is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while also copying data and threatening to publish it if payment is not made. Like other groups of this type, it typically advertises victims on a dedicated leak site, posts samples or file lists to pressure organisations, and sometimes auctions or releases the material when negotiations stall. Public reporting on anubis has described the use of common initial-access techniques such as phishing, exploitation of remote-access services, or compromised credentials, followed by lateral movement and data staging before encryption. The group’s listing of Dermatology Associates should be treated as an unverified claim; it asserts that internal files were taken and customer data leaked, but independent confirmation of those specifics has not been provided in the facts available here. Prior activity by anubis has involved a range of sectors, including healthcare-related organisations, though each incident must be assessed on its own evidence.

Who is Dermatology Associates?

Dermatology Associates is a medical practice focused on skin health. Clinics of this kind routinely collect and store patient demographics, contact details, insurance information, medical histories, diagnoses, treatment notes, prescriptions, and sometimes photographs or biopsy results. They also maintain internal operational records such as staff files, schedules, and administrative correspondence. Because dermatology care often involves ongoing treatment of chronic or sensitive conditions, the data held can be both clinically detailed and personally revealing. A breach involving such an organisation is consequential precisely because the information is linked to real medical care; even limited exposure can affect patients’ privacy, insurance standing, or personal security, and can disrupt the clinic’s ability to deliver uninterrupted services.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack and characterise the incident as a leak of clinic customer data. No further breakdown—such as specific categories of patient records, financial data, or employee information—has been disclosed. Organisations of this type typically hold protected health information under medical privacy rules, along with identifiers that can be used for identity theft or social-engineering attacks. Because the exact contents remain unconfirmed, it is not possible to state with certainty which fields or files were taken. Readers should therefore treat any assumption about particular data elements as provisional until the organisation or independent investigators provide verified details.

The real-world impact

For individuals, the practical risks include potential misuse of personal identifiers for fraud, targeted phishing that references medical details, or unwanted disclosure of health conditions. Even if clinical notes themselves are not released, customer data such as names, addresses, dates of birth, or insurance numbers can enable account takeovers or insurance-related scams. For the clinic, the consequences can include operational disruption, regulatory notification duties, reputational damage, and the cost of investigation and remediation. Because the number of people affected is unknown, the scale of any notification or support effort cannot yet be assessed. The absence of Reported Details does not eliminate the risk; it simply means affected parties must proceed with caution until more is known.

What to do if you're exposed

If you have been a patient or employee of Dermatology Associates, begin by monitoring financial and medical accounts for unusual activity and consider placing a fraud alert or credit freeze with the major credit bureaus. Review any correspondence from the clinic carefully and verify its authenticity before responding or clicking links. Change passwords on related accounts, enable multi-factor authentication where available, and be alert to phishing attempts that reference dermatology care or personal details. Keep records of any notifications you receive. As a further practical step, you can run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets; this can help you prioritise further protective measures while official updates are awaited.

AICompiled with AI assistance from public sources and published under our editorial standards.