Heartcentre Listed by dragonforce Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have attended Heartcentre clinics for cardiac investigations or therapy may now face uncertainty about whether their personal or medical details have been taken. On 16 January 2025 the organisation was listed by the ransomware group dragonforce, which claims to have exfiltrated internal files. The number of individuals affected remains unknown, and public detail on exactly what was taken is limited, yet any exposure of health-related records carries lasting practical consequences for those involved.

Because Heartcentre operates as a specialist medical service, the incident raises immediate questions about privacy, potential misuse of sensitive information, and the steps patients and staff should take while fuller confirmation is still pending.

Breaking down the breach

According to the available record, Heartcentre was listed by the dragonforce ransomware group on 16 January 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No public confirmation has been issued that the claim has been independently verified, and the precise method of intrusion, the volume of data removed, and the exact date of the intrusion itself have not been disclosed.

The organisation maintains three sites—at Castle Hill, Merrylands West and Rouse Hill—staffed by professional clinicians who provide prompt access to cardiac investigations and therapy. Beyond the statement that internal files were taken, further technical or operational details of the incident remain undisclosed. The number of people whose information may have been involved is listed as unknown.

The group behind it: dragonforce

Dragonforce is a ransomware operation that has been active in recent years and is known for a double-extortion model: encrypting systems while simultaneously copying data and threatening to publish it on a dedicated leak site if payment is not made. The group typically posts victim names and sample claims on its dark-web portal to apply pressure. Public reporting has linked dragonforce to attacks across multiple sectors, often involving the theft of internal documents before encryption.

In this case the group claims Heartcentre as a victim and states that internal files were exfiltrated. No additional statements from dragonforce specifically about the contents of those files, any ransom demand, or subsequent publication of Heartcentre data have been recorded in the available facts. The listing itself should therefore be treated as an unverified claim pending further confirmation.

Who is Heartcentre?

Heartcentre is a specialist cardiac service operating three clinics in the Sydney region—Castle Hill, Merrylands West and Rouse Hill. It employs professional medical staff and offers patients rapid access to diagnostic investigations and therapy related to heart health. Organisations of this type routinely handle clinical records, referral letters, test results, appointment histories and contact details for patients and referring practitioners.

A breach at a cardiac centre is consequential because the information such clinics hold is both personal and medical. Even limited exposure can affect patient trust, clinical continuity and regulatory obligations that apply to health-service providers. The three-site footprint means the potential impact could extend across a local patient population that relies on these facilities for ongoing care.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, patient identifiers, clinical notes or administrative records has been publicly named. Exact contents therefore remain unconfirmed.

Healthcare organisations of this kind typically store patient demographics, medical histories, diagnostic images or reports, treatment plans, billing information and staff records. Whether any of those categories were among the internal files claimed by dragonforce is not established. Until more detail emerges, it is accurate only to note that internal files are alleged to have left the organisation’s control.

What's at stake

For individuals, the principal risks are identity misuse, targeted phishing that references genuine medical details, and the long-term privacy impact of health information circulating outside clinical control. Even if the files prove to be administrative rather than clinical, contact data alone can enable social-engineering attempts. For Heartcentre the stakes include potential regulatory scrutiny, the cost of investigation and remediation, and the need to restore confidence among patients who depend on its services.

Because the scale of the exfiltration and the precise data types remain unknown, the full extent of harm cannot yet be quantified. The absence of confirmed numbers does not eliminate the possibility of real-world consequences for those whose records may have been involved.

Were you affected?

If you have been a patient or staff member at any of Heartcentre’s three sites, monitor financial and email accounts for unusual activity and treat unsolicited messages that reference medical appointments or test results with caution. Consider placing fraud alerts with credit-reporting agencies if you believe sensitive identifiers may have been exposed. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official notifications from Heartcentre or relevant authorities, if and when they are issued, should be followed carefully.

AICompiled with AI assistance from public sources and published under our editorial standards.