Primary Plus Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Primary Plus, a dental care provider with offices in Vanceburg and Maysville, Kentucky, was listed by the qilin ransomware group on December 11, 2024. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and further details about the incident have not been disclosed.

The listing itself is a claim by the group rather than independent confirmation of every asserted detail. For patients and staff connected to Primary Plus, the episode raises practical questions about what information may have been taken and what steps are reasonable next.

Inside the incident

According to available public information, Primary Plus was named on a qilin-associated leak site on December 11, 2024. The report states that internal files were exfiltrated in a ransomware attack. No confirmed figures have been released for the volume of data involved, the exact date the intrusion began, or the technical method used to gain access. The number of individuals whose information may have been exposed is listed as unknown. Beyond the claim of file exfiltration, public detail on the scope and timeline of the incident remains limited.

Who is qilin?

Qilin is a ransomware group that has operated for several years under a ransomware-as-a-service model. Public reporting on the group describes a pattern in which affiliates gain access to networks, encrypt systems, and exfiltrate data before demanding payment, often threatening to publish stolen material if the demand is not met. The group has previously listed organizations across multiple sectors on its leak sites. In this case, the appearance of Primary Plus on such a listing constitutes a claim by the group; independent verification of the full contents or the precise circumstances of the intrusion has not been provided in the available facts.

Who is Primary Plus?

Primary Plus operates dental care services from two locations in Kentucky: Vanceburg, situated in Building D at the 211 KY 59 PrimaryPlus campus, and Maysville. Public descriptions note that the Vanceburg office features care from Ron Mays, DMD, who has more than 30 years of service. As a dental practice, the organization sits within the healthcare sector, where patient records, appointment systems, billing information, and internal administrative files are routinely handled. A ransomware incident affecting such a provider is consequential because healthcare entities typically store sensitive personal and medical data that can be used for identity theft, insurance fraud, or further social-engineering attempts if it leaves the organization.

What data was at risk

The facts state that internal files were exfiltrated in the ransomware attack. No more granular inventory of those files has been publicly disclosed. Organizations of this type commonly hold patient demographic details, treatment notes, insurance information, contact data, and internal operational records. Because the exact contents of the exfiltrated material remain unconfirmed, it is not possible to state with certainty which specific categories were taken. The only confirmed characterization available is that internal files were removed as part of the attack claimed by the group.

The real-world impact

For individuals who have received care at Primary Plus, the principal risk is that personal or medical information contained in internal files could be misused if it has been obtained by unauthorized parties. That misuse can include attempts to open accounts, file false insurance claims, or craft convincing phishing messages that reference real treatment details. For the organization itself, the incident can disrupt operations, require forensic investigation and system restoration, and create ongoing notification and support obligations toward patients and staff. Because the number of people affected is unknown and the precise data types beyond “internal files” are not detailed, the scale of these effects cannot yet be quantified from public sources.

If your data was in this claimed breach

Anyone who has been a patient or employee of Primary Plus should monitor financial and insurance statements for unexpected activity and consider placing fraud alerts with the major credit bureaus. Review any communications that claim to come from the practice and verify them through known contact channels rather than links or phone numbers supplied in unsolicited messages. Change passwords on accounts that may have reused credentials associated with the practice, and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets, which can help prioritize further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.