molars.co.ke Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list organisations of every size on public leak sites, turning routine operational data into leverage and leaving patients and staff to wonder what, if anything, has left the network. In early January 2025 one such listing named molars.co.ke, a Nairobi dental practice, as a claimed victim of the RansomHub group. Public detail remains limited, yet the claim itself is enough to warrant careful attention from anyone who has ever been a patient or employee there.

What is known is straightforward: the group asserts that internal files were taken during a ransomware attack and that the organisation has been added to its leak site. No independent confirmation of the intrusion, the volume of data, or the identities of affected individuals has been published. The incident therefore sits in the familiar grey zone of modern ransomware reporting—serious enough to monitor, incomplete enough that speculation would only add noise.

Inside the incident

According to the available record, molars.co.ke was listed by the RansomHub ransomware group on or around 6 January 2025. The sole concrete description supplied is that internal files were allegedly exfiltrated in the course of a ransomware attack. No further technical details—how the attackers gained access, which systems were encrypted, whether a ransom demand was issued, or whether any data has actually been published—have been disclosed. The number of people whose information may be involved is likewise unknown. In short, the public picture consists of a leak-site claim and a brief characterisation of the material as internal files; everything else remains unconfirmed.

Who is ransomhub?

RansomHub is a ransomware-as-a-service operation that became prominent after the disruption of larger predecessors such as LockBit. Like many of its peers, the group typically employs double-extortion tactics: encrypting systems while simultaneously copying data, then threatening to publish the stolen material on a dedicated leak site if payment is not made. Affiliates handle the initial intrusion and deployment; the core operators manage the infrastructure and the public naming of victims. The group has previously claimed attacks against organisations across healthcare, manufacturing, education and professional services. Its listings are assertions of compromise, not verified admissions by the named parties. In the present case, the appearance of molars.co.ke on the RansomHub site should therefore be read as the group’s claim rather than as independently established fact.

Who is molars.co.ke?

Molars.co.ke is a dental practice based in Nairobi, Kenya. It provides general dentistry, orthodontics, oral surgery and related oral-health services, employing modern equipment and a team of professional dentists. Like most clinical practices of its kind, it necessarily collects and stores patient contact details, medical and dental histories, appointment records, billing information and, in many cases, identity documents required for treatment or insurance. A breach at such an organisation is consequential because the data it holds is both personal and medically sensitive; even a limited set of internal files can contain enough information to enable identity misuse, targeted phishing or embarrassment for patients who expect clinical confidentiality.

The information in question

The only description given is that internal files were allegedly exfiltrated. No inventory of file types, no sample documents and no confirmation of patient records, staff data or financial material have been released. Organisations of this kind typically maintain electronic health records, scheduling systems, correspondence with laboratories and insurers, and administrative documents. Whether any of those categories were among the files claimed by RansomHub is unconfirmed. Readers should therefore treat the precise contents as unknown until more reliable information appears.

The real-world impact

For patients and staff the practical risks are familiar: possible exposure of names, contact details, treatment notes or payment information could lead to phishing attempts that reference genuine appointments or diagnoses, or to identity-related fraud if identity documents were included. The organisation itself faces operational disruption, potential regulatory scrutiny under Kenya’s data-protection framework, and the longer-term task of restoring trust. Because the scale of the claimed exfiltration and the identities of any affected individuals remain undisclosed, the actual harm cannot yet be measured; the prudent stance is to assume that anyone who has interacted with the practice may need to take basic protective steps until clearer information emerges.

If your data was in this claimed breach

If you have been a patient or employee of molars.co.ke, treat the listing as a prompt for ordinary hygiene rather than as proof that your records are already circulating. Change passwords that may have been reused, enable multi-factor authentication wherever available, and watch for unexpected messages that reference dental appointments or personal details. Monitor financial and identity accounts for unusual activity. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a scan will not confirm involvement in this specific incident, but it can surface earlier exposures that deserve attention. Until more facts are established, measured caution is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.