dmos.com Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 13, 2023, the orthopaedic care organisation dmos.com was listed by the ransomware group lockbit3. Public reporting states that internal files were exfiltrated in a ransomware attack, with a claimed data volume of 278.69 GB. The number of people affected remains unknown, and independent confirmation of the full scope is limited.

The listing matters because healthcare-related organisations typically hold sensitive operational and patient-adjacent records. When a ransomware group claims to have taken internal files, patients, staff, and partners have a practical interest in understanding what is known, what is only claimed, and what steps reduce follow-on risk.

Inside the incident

According to the public record tied to this listing, dmos.com appeared on lockbit3’s leak site on or around March 13, 2023. The available summary describes a ransomware attack in which internal files were allegedly exfiltrated. The claimed volume is 278.69 GB. Named content categories in that summary include scans, purchasing information, marketing information, contracts, insurance documents, and additional unspecified materials.

How the attackers gained access, whether encryption was deployed alongside theft, whether a ransom was demanded or paid, and whether the organisation has issued its own detailed confirmation are not established in the facts provided. The count of affected individuals is unknown. Beyond the leak-site listing and the summary volume and content labels, public detail on timing, intrusion method, and full inventory remains limited.

The group behind it: lockbit3

Lockbit3 is a well-documented ransomware operation that has operated as a ransomware-as-a-service model. Affiliates typically gain access to networks, move laterally, exfiltrate data, and deploy encryption, then pressure victims by threatening to publish stolen files on a dedicated leak site if payment is not made. This double-extortion pattern—theft plus encryption threat—has been a hallmark of the brand across many sectors.

The group has been associated with high-volume campaigns against organisations of varying sizes worldwide. Listings on its site are claims by the actors; they are not, by themselves, independent verification that every asserted file set was taken or that every named victim’s systems were fully compromised in the manner described. In this case, lockbit3 claims dmos.com as a victim and associates the listing with the exfiltration of internal files at the stated volume. No further specific statements by the group about this victim are included in the facts beyond that listing and summary.

dmos.com and its sector

DMOS Orthopaedic Centers, associated with dmos.com, is described in the available summary as having provided orthopaedic care in Central regions since 1955, focusing on quality and innovative treatment for patients. Organisations of this type sit in the healthcare delivery sector: clinics and specialty centres that schedule care, manage clinical documentation, handle billing and insurance workflows, and maintain vendor and purchasing relationships.

A breach affecting such an entity is consequential because healthcare operations concentrate both personal health information and the administrative data needed to run appointments, procedures, supply chains, and coverage. Even when the exact patient-level exposure is unconfirmed, disruption or leakage of contracts, insurance materials, scans, and purchasing records can affect continuity of care, privacy, and trust among patients and partners.

What data was at risk

The facts name exposed material as internal files exfiltrated in a ransomware attack. The reported summary gives a volume of 278.69 GB and lists contents as follows:

• Scans
• Purchasing information
• Marketing information
• Contracts
• Insurance documents
• Additional unspecified materials (“and more”)

The number of people affected is unknown. Exact file inventories, whether clinical images or identifiable patient records were included in the “scans” or other categories, and whether credentials or financial account numbers were present are not confirmed in the provided facts. Organisations in orthopaedic and outpatient care typically hold appointment and demographic data, clinical notes and imaging, insurance and billing records, employee information, and vendor contracts; that is the general profile of the sector, not a verified contents list for this incident. Readers should treat the lockbit3 content labels as the group’s claim unless corroborated elsewhere.

The real-world impact

For individuals, risk depends on what actually left the network. If insurance documents, contracts, or scans tied to real people were included, possible outcomes include targeted phishing that references real administrative details, identity or insurance fraud attempts, and unwanted contact. Purchasing and marketing files can expose business relationships and internal processes that social engineers later misuse. Because the affected population size is unknown, it is not possible to state how widely those risks extend.

For the organisation, consequences can include operational disruption during response and recovery, regulatory and contractual notification duties common in healthcare, reputational harm, and the cost of investigation, containment, and patient or partner communication. None of these outcomes are asserted here as proven results of this specific case; they are the concrete categories of harm that typically follow confirmed ransomware-related exfiltration in this sector when sensitive internal files are involved.

If your data was in this claimed breach

If you are a patient, employee, or partner of DMOS Orthopaedic Centers or dmos.com, treat the incident as a prompt to tighten ordinary defences rather than as proof that your file was taken. Monitor insurance explanations of benefits and credit activity for unfamiliar claims or accounts. Be sceptical of unexpected calls or messages that cite orthopaedic care, billing, or contracts and push for urgent action or payment. Prefer official channels you look up yourself when verifying any outreach. Change passwords on related accounts if you reused them, and enable multi-factor authentication where available. Keep records of any suspicious contact.

You can also run a free exposure scan of your email to check whether your information has already surfaced in known breach data sets. That check does not confirm or deny inclusion in this specific incident, but it helps you see whether your addresses or related credentials appear in broadly circulated breach collections and prioritise further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.