Plastic Surgeon Kristin Tarbet (Bellevue, Wash) Listed by maze Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or medical information is held by healthcare providers can face lasting privacy and identity risks when those records are targeted in cyberattacks. On May 5, 2020, Plastic Surgeon Kristin Tarbet in Bellevue, Washington, was listed on a site associated with the Maze ransomware group. The listing states that internal files were taken during a ransomware incident, though the number of individuals affected and the full scope of any exposure remain unknown.

Inside the incident

The event was reported through the Maze ransomware leak site on May 5, 2020. The listing identifies the plastic surgery practice as the target and claims that internal data was exfiltrated. No further details on the intrusion method, timeline of the attack, or volume of records have been made public. The number of people whose information may be involved is also undisclosed.

Inside maze

Maze is a ransomware group that has conducted operations involving both file encryption and data theft. Public reporting on the group describes a pattern of listing victim organizations on a dedicated site when ransom demands are not met. Maze has appeared in connection with incidents across healthcare, government, and corporate sectors, using the threat of data release as an additional pressure tactic.

About Plastic Surgeon Kristin Tarbet (Bellevue, Wash)

The organization is a medical practice specializing in plastic surgery and located in Bellevue, Washington. Practices of this type routinely collect and store patient identifiers, medical histories, treatment records, insurance details, and billing information. A breach at such a provider can expose sensitive health data that is protected under regulations governing medical privacy.

The information in question

The only data category named in connection with the listing is internal files exfiltrated during a ransomware attack. The precise contents of those files have not been confirmed publicly. Organizations in this sector commonly hold electronic health records, appointment data, and financial information, but it is not possible to state which specific records, if any, were involved here.

Why it matters

Medical practices hold information that can be used for identity theft, insurance fraud, or targeted scams. When internal files are removed without authorization, affected individuals may experience unauthorized access to their health or financial details over an extended period. The organization itself faces operational disruption and potential regulatory scrutiny following any confirmed ransomware event.

Were you affected?

Patients of the practice who have not received direct notification can begin by reviewing statements from their insurer and medical providers for unusual entries. Contacting the practice directly remains the primary route for official information about any follow-up steps it may offer.

• Review credit reports and medical statements for anomalies.
• Place fraud alerts with major credit bureaus if concerned about identity misuse.
• Run a free exposure scan of your email address against known breach datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.