drwu.com Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 17, 2026, the ransomware group lockbit5 listed drwu.com on its leak site and stated that internal files had been taken from the organization. The number of people whose information may be involved is not known, and no further details on the volume or contents of the material have been made public. The incident leaves individuals who have interacted with drwu.com uncertain about whether their records form part of the claimed exfiltration.

Breaking down the breach

The only confirmed public information is the listing itself and the assertion that internal files were removed during a ransomware operation. No date of the intrusion, no count of affected records, and no description of the encryption or exfiltration method have been disclosed. The organization has not issued a statement confirming or denying the claims.

The group behind it: lockbit5

LockBit is a ransomware-as-a-service operation that has been active for several years. Its operators typically gain access through compromised credentials or unpatched systems, deploy encryption across networks, and then list victim names on a dedicated leak site while threatening to publish stolen data unless a ransom is paid. The group has claimed responsibility for incidents across multiple sectors in public reporting. In this case the listing of drwu.com constitutes the group’s claim; independent confirmation of the data theft has not been reported.

About drwu.com

drwu.com was established in 2003 by dermatology professor Dr. Wu and his son Eric Wu. The organization operates in the dermatology field, a sector that routinely collects and stores patient medical histories, contact details, appointment records, and billing information. A breach at such an entity can therefore involve sensitive personal and health-related data even when the precise files taken remain unspecified.

What was likely exposed

The facts released so far state only that internal files were exfiltrated. No inventory of file types or data categories has been provided. Organizations of this kind commonly hold patient identifiers, medical notes, and financial records, yet the exact contents of the material claimed by lockbit5 are unconfirmed.

Why it matters

Health-related information, if released, can be used for targeted fraud or identity misuse over long periods because medical records are difficult to change. The absence of a confirmed count of affected individuals means anyone who has been a patient or client of drwu.com has no immediate way to assess personal exposure from public statements alone. For the organization, the listing adds pressure to manage both operational recovery and any regulatory obligations that may follow.

What to do if you're exposed

Individuals concerned about possible involvement can begin with basic protective steps while waiting for official notification.

• Monitor bank and insurance statements for unusual activity.
• Place a fraud alert or credit freeze with major credit bureaus if financial details could be involved.
• Change passwords on any accounts linked to the organization and enable multi-factor authentication where available.
• Run a free exposure scan of your email address against known breach data to check for prior appearances of your information.

AICompiled with AI assistance from public sources and published under our editorial standards.