drcloudemr.com Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare technology providers as a high-value pathway into sensitive patient and operational data, exploiting the sector’s reliance on cloud-hosted systems and the pressure to restore services quickly. Against that backdrop, the listing of drcloudemr.com by the safepay ransomware group on 14 August 2025 adds another entry to a growing catalogue of claimed attacks on electronic health record platforms.

Public reporting states that internal files were exfiltrated in a ransomware attack against DrCloudEHR, the organisation behind drcloudemr.com. The number of people affected remains unknown, and further technical details have not been released. The incident matters because the company supplies cloud-based electronic health record and practice-management software used by ambulatory clinics, placing clinical and administrative records at potential risk.

What happened

On 14 August 2025, the safepay ransomware group listed drcloudemr.com on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. The organisation is identified as DrCloudEHR (also referenced as DrCloud or DrCloudEMR). No public confirmation of the listing has been issued by the company, the precise date of the intrusion is undisclosed, and the scale of the compromise—including the number of systems or individuals involved—has not been stated. Method of initial access and any ransom demands remain unconfirmed in available reporting.

The group behind it: safepay

Safepay is a ransomware operation that has appeared in public threat reporting since late 2024. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while simultaneously claiming to steal data and threatening to publish it if payment is not made. Victims are routinely listed on a dedicated leak site, often accompanied by sample files or countdown timers. Prior activity attributed to the group has spanned multiple sectors, including professional services and technology providers, though specific claims about any single victim must be treated as unverified assertions until independently confirmed. In this case, the group claims to have exfiltrated internal files from drcloudemr.com; that claim has not been corroborated by the organisation or by independent forensic disclosure.

drcloudemr.com and its sector

DrCloudEHR operates a cloud-hosted electronic health record and practice-management platform aimed primarily at ambulatory clinics and smaller healthcare practices. Such systems typically store patient demographics, clinical notes, appointment schedules, billing information and insurance details, and they often integrate with laboratory, pharmacy and imaging services. Because the software is delivered as a multi-tenant cloud service, a successful intrusion can affect not only the provider’s own corporate data but also the records of the clinics that rely on it. Healthcare technology vendors occupy a critical position in the care continuum; disruption or data exposure at this layer can cascade to multiple independent practices and the patients they serve.

What was likely exposed

The only data type named in public reporting is “internal files” said to have been exfiltrated during the ransomware attack. Exact contents, file counts and whether patient health information was included remain undisclosed. Organisations of this type ordinarily hold a mixture of corporate records (contracts, employee data, system configurations) and, depending on architecture and access controls, copies or caches of clinical and administrative data belonging to client practices. Until the company or independent investigators release a confirmed inventory, any assertion about specific categories of personal or protected health information would be speculative.

The real-world impact

For individuals whose information may have been present in the exfiltrated files, the principal risks include identity theft, medical fraud and targeted phishing that leverages accurate personal or clinical details. Clinics that use the platform face potential operational disruption, regulatory notification obligations and the cost of forensic review and patient outreach. The organisation itself must contend with reputational damage, possible contractual claims from customers, and the resource burden of containment and recovery. Because the number of affected people is unknown and the precise data set unconfirmed, the full scope of these consequences cannot yet be quantified.

Were you affected?

If you are a patient or staff member at a clinic that uses DrCloudEHR services, or if you have an account or correspondence linked to drcloudemr.com, consider the following practical steps:

• Monitor bank, credit and insurance statements for unfamiliar activity and place a fraud alert with major credit bureaus if warranted.
• Treat unsolicited emails or calls that reference medical appointments, billing or personal details with heightened caution; verify any request through official channels.
• Change passwords for any accounts that may have shared credentials with the affected service and enable multi-factor authentication where available.
• Retain copies of any breach notification you receive and follow the specific guidance it contains.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this incident remains limited; further clarity will depend on official statements from DrCloudEHR or regulatory filings.

AICompiled with AI assistance from public sources and published under our editorial standards.