performance-therapies Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 1 October 2024 the ransomware group qilin listed Performance Therapies on its leak site, claiming that internal files had been taken in an attack. For patients, staff and anyone who has shared personal or clinical details with the practice, the practical stakes are immediate: medical histories, contact information and administrative records of the kind routinely held by therapy providers can become tools for fraud, targeted phishing or long-term privacy harm if they circulate beyond the organisation’s control. Public detail remains limited, yet the listing itself is enough to warrant careful attention from those who may be affected.

Performance Therapies, P.C. is a physical-therapy practice that has operated since 1999. When a provider of this type appears on a ransomware leak site, the concern is not abstract; it centres on whether sensitive health-related data has left the organisation’s systems and what that means for the people named in those files.

Inside the incident

According to the available record, Performance Therapies was listed by the qilin ransomware group on 1 October 2024. The group claims that internal files were exfiltrated during a ransomware attack. The number of people affected is unknown, and no further technical details—such as the initial access method, the duration of the intrusion, the volume of data taken or any ransom demand—have been disclosed in the public summary. The only organisational description attached to the listing is a brief company history noting that the practice began in the founder’s basement in 1999 and has since expanded through dedicated service. Beyond that statement and the assertion that internal files were removed, the precise scope and timeline of the incident remain unconfirmed.

The group behind it: qilin

Qilin is a well-documented ransomware-as-a-service operation that has been active for several years. The group typically follows a double-extortion model: it encrypts systems and simultaneously steals data, then threatens to publish the stolen material on a dedicated leak site if payment is not made. Affiliates of the service are known to target organisations across healthcare, professional services and other sectors that hold valuable personal records. Public reporting on qilin has repeatedly shown that the group posts victim names and sample data to pressure organisations, yet each listing remains a claim until independently verified. In this case the facts state only that Performance Therapies was listed and that internal files were said to have been exfiltrated; no additional statements attributed to qilin about this specific victim have been provided.

About performance-therapies

Performance Therapies, P.C. is a physical-therapy practice that, by its own account, has grown steadily since its founding in 1999. Organisations of this kind deliver outpatient rehabilitation, injury recovery and related clinical services. In the course of ordinary operations they collect and store patient intake forms, treatment notes, insurance details, billing records, staff employment information and routine administrative correspondence. Because physical-therapy providers sit at the intersection of healthcare and personal data, a breach involving their systems can expose both medical and identity-related information. The consequential nature of such an incident lies in the sensitivity of those records and the trust patients place in the practice to keep them confidential.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” Exact file types, patient counts or categories of data have not been disclosed. Organisations that provide physical therapy typically hold protected health information, contact details, insurance identifiers, appointment histories and internal operational documents. Whether any of those categories were among the files claimed by qilin is unconfirmed. Until more precise inventories are released by the organisation or by independent investigators, the contents of the exfiltrated material must be treated as unknown.

The real-world impact

For individuals whose information may have been involved, the risks are concrete even if the exact data set remains unclear. Medical and personal records can be used to craft convincing phishing messages, open fraudulent accounts or submit false insurance claims. Staff members face similar exposure of payroll, identity or employment data. For the practice itself, the incident can disrupt clinical operations, trigger regulatory notification duties under health-privacy rules, and require sustained effort to restore systems and rebuild patient confidence. Because the number of affected people is unknown, the full scale of these effects cannot yet be measured; the prudent assumption is that anyone who has been a patient or employee should treat the possibility of exposure seriously until clearer information emerges.

What to do if you're exposed

If you have been a patient, client or employee of Performance Therapies, practical first steps can reduce the chance of further harm. Consider the following measures:

• Monitor bank, credit-card and insurance statements for unfamiliar charges or claims.
• Place a fraud alert or credit freeze with the major credit bureaus if identity documents may have been involved.
• Be alert to unexpected emails or calls that reference your therapy history or personal details; verify any request through official channels.
• Request a copy of your medical records from the practice so you know what information they hold and can check for inaccuracies.
• Change passwords on any accounts that reused credentials associated with the practice and enable multi-factor authentication where available.

Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Staying informed through official statements from the organisation remains the most reliable way to learn whether further notifications or support will be offered.

AICompiled with AI assistance from public sources and published under our editorial standards.