MSSNY Listed by snatch Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional associations and healthcare-adjacent organisations, treating membership bodies as repositories of concentrated personal and operational data. In that landscape, the appearance of a state medical society on a leak site is a signal worth examining carefully, even when public detail remains thin.

On 22 May 2023 the Medical Society of the State of New York, known as MSSNY, was listed by the ransomware group snatch. The listing asserts that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and independent confirmation of the full scope has not been made public. For physicians, residents, students and staff connected to the organisation, the claim alone raises practical questions about what may have left the network and what steps are warranted.

What happened

Public reporting states that MSSNY was listed by the snatch ransomware group on 22 May 2023. According to the available summary, the incident involved the exfiltration of internal files in a ransomware attack. No further technical detail—such as the initial access method, the duration of unauthorised presence, the precise volume of data taken, or any ransom demand—has been disclosed in the material provided. The number of individuals whose information may be involved remains unknown. The group’s leak-site listing constitutes a claim by the actors; it has not been independently verified in the facts at hand.

The group behind it: snatch

Snatch is a ransomware operation that has been observed for several years. Like many groups in this category, it typically combines data theft with encryption, then pressures victims by threatening to publish stolen material on a dedicated leak site. Public reporting on snatch has described a pattern of targeting organisations across multiple sectors, often with an emphasis on exfiltration before or alongside encryption. The group has been associated with double-extortion tactics in which the threat of public release is used to increase leverage. These characteristics are drawn from established open-source descriptions of the actor’s general methods; they do not constitute confirmed specifics about the MSSNY incident beyond the group’s own listing claim.

Because leak-site posts are controlled by the attackers, they must be treated as unverified assertions until corroborated by the victim organisation, regulators, or forensic reporting. In this case the facts record only that MSSNY was listed and that internal files were described as exfiltrated.

Who is MSSNY?

The Medical Society of the State of New York is a professional membership organisation representing approximately 30,000 licensed physicians, medical residents, and medical students across New York State. Members typically participate both in the statewide society and in their local county medical societies. Organisations of this type serve as advocates, educators, and conveners for the medical profession; they commonly maintain membership directories, communications systems, event and continuing-education records, and internal administrative files.

A breach affecting such a body is consequential because the organisation sits at the intersection of professional identity data and the broader healthcare ecosystem. Even when clinical patient records are not the primary holdings, membership and administrative systems can contain names, contact details, licensure-related information, financial or dues records, and internal correspondence. Compromise of those systems can create downstream risk for individuals and can disrupt the society’s ability to serve its members.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No itemised inventory of data types—such as specific categories of personal identifiers, financial records, or credentials—has been disclosed. The exact contents therefore remain unconfirmed.

Professional medical societies of this scale typically hold membership databases, contact and demographic information, records related to dues or events, internal policy and administrative documents, and correspondence. Whether any of those categories were among the files claimed by snatch is not established in the public summary. Readers should treat the exposure as involving internal organisational material whose precise composition has not been detailed.

Why it matters

When internal files leave an organisation under ransomware conditions, the immediate risks are misuse of any personal or professional data contained in those files and potential secondary attacks that leverage the stolen material. For physicians, residents, and students, that can mean targeted phishing, identity-related fraud, or attempts to impersonate the society or its members. For the organisation itself, the incident can affect member trust, operational continuity, and regulatory or contractual obligations around data protection.

Because the number of people affected is unknown and the file contents are not itemised, the practical impact cannot be quantified from public information alone. The absence of confirmed scale does not eliminate the need for vigilance; it simply means individuals and the organisation must proceed on the basis of incomplete visibility rather than a full accounting.

If your data was in this claimed breach

If you are a member, employee, or other individual connected to MSSNY, treat the snatch listing as a prompt to review your own exposure rather than as definitive proof that your specific records were taken. Concrete first steps include:

• Monitor financial and credit accounts for unfamiliar activity and consider a fraud alert if you have reason for heightened concern.
• Be alert to phishing or social-engineering attempts that reference the medical society, licensure, or professional networks.
• Change passwords on accounts that may have shared credentials or recovery information with society-related systems, and enable multi-factor authentication where available.
• Retain any official notices from MSSNY and follow guidance issued by the organisation or relevant authorities.
• Run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets.

Public detail on this incident remains limited. Continued attention to official statements from MSSNY and to reputable breach-notification channels is the most reliable way to learn whether additional confirmed information becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.