Healthcare & More Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Healthcare & More was listed by the dragonforce ransomware group on November 22, 2025, with internal files reported as exfiltrated. Individuals are advised to check whether their information was exposed and to take protective steps.
Breaking down the breach
The only confirmed public information is the November 22, 2025 listing itself. DragonForce asserts that it conducted a ransomware operation and obtained internal files. No independent verification of the data volume, encryption status, or restoration outcomes has been published. The number of people whose information may be involved is not disclosed.
Who is dragonforce?
DragonForce is a ransomware-as-a-service operation that has been publicly active since at least 2023. The group typically deploys ransomware on compromised networks and conducts data exfiltration before encryption, then lists victim names on a dedicated leak site to pressure organizations into paying ransoms. Its listings have included entities in healthcare, finance, and government sectors. As with other ransomware groups, the accuracy of individual claims varies and is not independently verified until the victim or law enforcement confirms details.
Who is Healthcare & More?
Healthcare & More, also referenced as Healthcare & Moore, is an independent insurance brokerage led by Myra “Lynn” Moore. It focuses on Medicare plans, health insurance, life insurance, annuities, and dental coverage, with particular emphasis on assisting senior clients. The firm states it maintains access to products from more than 300 insurers. Organizations of this type routinely collect and store personal and financial details required for policy applications and claims processing.
What data was at risk
The listing refers only to “internal files exfiltrated in ransomware attack.” No specific categories of data—such as names, Social Security numbers, medical records, or payment information—have been named in public reports. Insurance brokerages commonly hold client identifiers, policy details, and health-related information necessary for enrollment and billing, but the exact contents of any exfiltrated material remain unconfirmed.
Why it matters
Insurance records can contain sensitive personal and financial information that retains value for identity theft or fraud over long periods. When such data circulates among criminal networks, affected individuals may face increased risk of account takeover or targeted scams. For the brokerage, the incident adds operational costs for investigation, potential regulatory notification, and client communication, regardless of whether ransom demands were met.
If your data was in this claimed breach
Monitor statements from Healthcare & More for official guidance on any confirmed exposure. Enable multi-factor authentication on insurance and financial accounts, review statements for unauthorized activity, and consider placing a fraud alert with credit bureaus. Readers can run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Neurological Associates Listed by dragonforce Ransomware GroupPrecision Compounding Listed by dragonforce Ransomware GroupHealthcare Retroactive Audits Listed by dragonforce Ransomware GroupEmerson Chiropractic Listed by dragonforce Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Healthcare & More Listed by dragonforce Ransomware Group →
Publicly posted by dragonforce — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.