My New Jersey Dentist Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and related service providers, treating patient-facing practices as sources of sensitive records that can be stolen and used for pressure. In that landscape, listings on criminal leak sites have become a common way for attackers to claim success and threaten public release of data. One such claim involves My New Jersey Dentist, a dental practice whose name appeared in connection with the rhysida ransomware group.

Public reporting on 12 February 2025 stated that My New Jersey Dentist had been listed by rhysida. The group claims that internal files were taken in a ransomware attack and that a large volume of material was made available. The number of people affected remains unknown, and independent confirmation of the full scope is limited. For patients and staff, the listing raises practical questions about what may have been exposed and what steps to take next.

Inside the incident

According to the available public record, My New Jersey Dentist was listed by the rhysida ransomware group on or around 12 February 2025. The listing is presented as the result of a ransomware attack in which internal files were allegedly exfiltrated. The group’s own materials associated with the listing describe a data catalog of 965 Gb comprising 683,219 files and state that the material was uploaded for public access. Those figures and the claim of full public upload come from the group and have not been independently verified in the facts provided.

No further detail has been disclosed about how the intrusion occurred, when it began, how long the attackers remained inside the environment, or whether encryption of systems accompanied the theft of data. The number of individuals whose information may be involved is unknown. Beyond the group’s description of “internal files,” the exact composition of the claimed archive is not confirmed in public reporting. In short, the incident is known primarily through the leak-site claim and the associated volume figures; method, precise timing, and verified impact remain undisclosed.

Inside rhysida

Rhysida is a ransomware operation that has been active in recent years and is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group typically operates a leak site where it names victims, posts samples or catalogs of stolen material, and sets deadlines. Like other ransomware brands, it has targeted organizations across sectors, including healthcare and professional services, where the combination of operational disruption and sensitive records can increase pressure to pay.

Public reporting on rhysida generally describes the use of phishing, exploitation of exposed remote access, or other common initial-access methods, followed by lateral movement, data staging, and deployment of ransomware. The group’s leak-site posts are claims intended to demonstrate possession of data; they are not independent audits. In this case, the listing of My New Jersey Dentist and the statements about file counts and public upload should be read as assertions by the group rather than confirmed findings by the victim or by investigators.

About My New Jersey Dentist

My New Jersey Dentist is a dental practice that, by its own public description, provides family dental care. Dental practices of this kind routinely maintain appointment systems, treatment records, billing information, insurance details, and communications with patients and insurers. They also hold staff and vendor records needed to run the business. Even a relatively small practice can accumulate years of clinical and administrative data that are valuable to criminals for identity fraud, insurance abuse, or further social engineering.

A breach involving a dental practice is consequential because the data often mixes personal identifiers with health-related information. Patients may not expect their dental records or contact details to appear in criminal marketplaces, and the practice itself faces operational, legal, and reputational consequences if systems are disrupted or if patient trust is damaged. The facts do not establish negligence or describe the practice’s security posture; they only record that the organization was named in a rhysida listing.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The group’s listing materials claim a catalog of 965 Gb and 683,219 files and assert that the material was made publicly available. Beyond that high-level description, specific data types—such as names, dates of birth, Social Security numbers, clinical notes, insurance identifiers, or financial records—are not itemized in the provided record. Whether every file in the claimed archive relates to patients, staff, or business operations is unconfirmed.

Organizations of this kind typically hold patient demographics, treatment and billing records, insurance correspondence, and internal administrative documents. It is reasonable to expect that a large internal archive could contain some combination of those categories, but the exact contents of what rhysida claims to have taken remain unverified. Readers should treat any assertion about particular fields or individuals as unconfirmed unless the practice or a regulator later provides a clear notice.

Why it matters

For people connected to the practice, the main risks are identity theft, targeted phishing, and misuse of health or billing information. Stolen contact details and partial medical or insurance data can be used to craft convincing messages that ask for further personal information or payments. Even if clinical notes are not fully exposed, administrative files can still enable fraud against insurers or against individuals. Because the number of affected people is unknown, anyone who has been a patient, employee, or close business contact of the practice has reason to stay alert rather than assume they are unaffected.

For the organization, a ransomware listing can mean operational disruption, notification obligations, potential regulatory scrutiny, and lasting damage to patient confidence. Restoring systems, investigating the intrusion, and communicating with patients all require time and resources. The group’s claim that data was uploaded for public access, if accurate, increases the chance that the material will be copied and redistributed beyond any single leak site, extending the window of risk for those whose information appears in the files.

Were you affected?

If you have been a patient, employee, or vendor of My New Jersey Dentist, treat the listing as a reason to take basic precautions. Watch bank, credit, and insurance statements for unexpected activity. Be cautious of unsolicited calls or emails that reference dental care, appointments, or billing and that ask for personal or payment details. Consider placing a fraud alert with the major credit bureaus if you believe sensitive identifiers may have been involved. The practice may issue formal notices if it confirms impact; until then, public detail remains limited.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not prove or disprove involvement in this specific incident, but it can help you see whether your address is circulating more widely and whether you should tighten passwords, enable multi-factor authentication, and monitor accounts more closely.

AICompiled with AI assistance from public sources and published under our editorial standards.