DOCTUS USA Inc Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What is known is that on July 10, 2026, the ransomware group Deadlock listed DOCTUS USA Inc on its leak site and stated that internal files had been taken during a ransomware attack. No figure has been released for the number of individuals whose information may be involved, and the company has not confirmed the incident or described its scope. The practical stakes center on medical documentation. Organizations that handle patient records hold information that can be used for identity theft, insurance fraud, or targeted scams if it reaches unauthorized parties. Until more details are released, the extent of any exposure remains unclear.

What happened

Deadlock listed DOCTUS USA Inc on its site on July 10, 2026, claiming that internal files were exfiltrated during a ransomware operation. The number of people affected has not been disclosed, and no further technical details about the intrusion method or the volume of data have been made public. The company has not issued a statement confirming or disputing the listing.

Inside Deadlock

Deadlock is a ransomware group that conducts double-extortion operations: it encrypts systems and also removes copies of data before demanding payment. The group maintains a leak site where it lists organizations it claims to have targeted, often posting samples or descriptions of stolen material to pressure victims. Such listings are presented by the group itself and are not independently verified at the time they appear.

Who is DOCTUS USA Inc?

DOCTUS USA Inc provides medical records services in the United States, focusing on the management and organization of medical documentation. Companies in this sector routinely receive, store, and process records that contain clinical details, patient identifiers, and administrative information from healthcare providers. A compromise at such a firm can therefore touch data that is both sensitive and subject to regulatory protections.

What data was at risk

The listing refers only to “internal files” taken in a ransomware attack. No specific categories of data, such as patient names, diagnoses, or billing records, have been named in public reports. Organizations that manage medical documentation typically hold protected health information and related administrative files, but the precise contents of any exfiltrated material remain unconfirmed.

The real-world impact

Individuals whose records may have been involved face the possibility that personal health or identifying details could be used for fraud or sold on illicit markets. For the organization, the incident adds to the operational and regulatory burdens that follow any ransomware event, including potential notification requirements and remediation costs. The absence of Reported Details means the scale of these effects cannot yet be measured.

What to do if you're exposed

Monitor statements from DOCTUS USA Inc and any official notifications that may follow. Review bank and insurance statements for unusual activity, and consider placing fraud alerts with credit bureaus if personal identifiers appear to be at risk. Readers can run a free exposure scan of their email address against known breach data to check whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.