Health Management Systems Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Health Management Systems was listed by the dragonforce ransomware group on March 19, 2026, after internal files were exfiltrated in a ransomware attack. The number of individuals affected has not been disclosed; anyone who has records with the organisation should review their accounts and monitor for unusual activity.
What happened
The incident came to light through a listing on the dragonforce group’s leak site on March 19, 2026. The group claims to have obtained internal files from Health Management Systems in the course of a ransomware operation. No information has been released about when the intrusion began, how long the attackers had access, or the scale of the data taken. The organisation has not issued a public statement confirming or disputing the claims, and independent verification of the listing’s contents is not available.
Inside dragonforce
Dragonforce is a ransomware group that publishes victim names and sample data on its leak site when ransom demands are not met. The group typically combines file encryption with data exfiltration, then uses the threat of publication to pressure targets. Its listings have covered organisations in multiple countries and sectors, though the accuracy and completeness of each claim vary and are not independently verified at the time of posting.
About Health Management Systems
Health Management Systems develops practice-management software for providers in community health, aged care and disability support. Its products handle scheduling, client records, budget tracking and reporting for government-funded schemes such as the NDIS. The company’s clients are organisations that deliver services to individuals under regulated funding arrangements, which means the systems often contain operational records tied to those services.
What was likely exposed
The only detail released is that internal files were allegedly exfiltrated. The precise categories of information contained in those files have not been disclosed. Organisations of this type commonly store staff rosters, client contact details, service notes and financial records related to funded care packages, but it is not confirmed whether any of these data types were among the files taken in this case.
The real-world impact
Exposure of internal operational files could create administrative and compliance burdens for the affected providers and their clients. Health and disability service records are subject to strict handling rules; any confirmed loss of such data would require notification to regulators and potentially to individuals. For the organisation itself, the incident adds costs for investigation, remediation and possible regulatory scrutiny, regardless of whether the files are later published.
Were you affected?
Check any direct communications you receive from Health Management Systems or your service provider. Review your usual accounts for unexpected activity and consider changing passwords for any portals linked to the affected software. You can also run a free exposure scan of your email address against known breach data sets to see whether your information appears in previously published lists.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
vipimaging Listed by dragonforce Ransomware GroupRamos Rheumatology Listed by dragonforce Ransomware GroupAdvancedHEALTH Listed by dragonforce Ransomware GroupAdvanced Medical Consultants Listed by dragonforce Ransomware GroupLatest breaches
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.