rwrhine.com Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have visited or been treated at a dental practice may have shared names, contact details, medical histories, insurance information and other personal records that they expect to stay private. When a ransomware group claims to have taken internal files from such a practice, those individuals face the practical risk that their information could be misused for identity fraud, targeted phishing or other harm. Public detail on this incident remains limited, but the listing itself is enough to warrant careful attention from anyone connected to the practice.

On January 30, 2025, the ransomware group known as safepay listed rwrhine.com on its leak site, asserting that it had exfiltrated internal files in a ransomware attack. The number of people affected is unknown, and no further Reported Details about the scale or exact contents of the material have been made public. The claim has not been independently verified in the available record, yet it places patients, staff and others associated with the practice in a position where vigilance is warranted.

Breaking down the breach

According to the reported information, rwrhine.com was listed by the safepay ransomware group on January 30, 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No public confirmation of the attack method, the precise date of intrusion, the volume of data taken, or any ransom demand has been disclosed. The number of individuals whose information may be involved is listed as unknown. In short, the core public fact is the group’s claim of having obtained and removed internal files; everything else about timing, technical entry point and full scope remains undisclosed.

Ransomware incidents of this type typically involve unauthorized access followed by both encryption of systems and theft of data for leverage. Because the available record does not describe the sequence of events or any recovery steps taken by the practice, it is not possible to state whether systems were restored from backups, whether law enforcement was notified, or whether any data has actually been published beyond the listing itself. Readers should treat the leak-site entry as an unverified claim until additional independent reporting or official statements appear.

Who is safepay?

Safepay is a ransomware operation that has been observed in public reporting since roughly mid-2024. Like many contemporary groups, it is associated with a double-extortion model: encrypting a victim’s systems while also copying data and threatening to release it on a dedicated leak site if payment is not made. The group has listed organizations across multiple sectors, often posting sample files or directories to demonstrate possession. Public analyses describe safepay as using relatively standard ransomware tooling and affiliate-style recruitment, though precise internal structure and membership remain opaque.

In this case, safepay’s listing of rwrhine.com constitutes a claim that the group obtained internal files. No additional statements attributed specifically to safepay about this particular victim—such as file counts, sample screenshots, or ransom amounts—are present in the provided facts. Therefore any assertion that the group “stole X records” or “demanded Y dollars” would be unsupported. The listing itself is the sole public allegation tying the group to this organization.

About rwrhine.com

Rwrhine.com is the online presence of a professional dental practice led by Dr. Richard W. Rhine and located in Hayward, California. The practice provides general and cosmetic dentistry, including preventive care, routine cleanings, restorative procedures and cosmetic treatments. Dental offices of this kind routinely collect and store patient demographic data, medical and dental histories, treatment notes, insurance details, billing records and sometimes imaging or laboratory results. They also maintain staff records, vendor contracts and internal administrative files.

A breach claim against a dental practice is consequential because the data such organizations hold is both personal and regulated. Patient health information falls under privacy rules that require safeguards, and any unauthorized access can create lasting exposure for individuals who trusted the practice with sensitive details. Even when the exact files taken remain unconfirmed, the nature of the sector means the potential impact extends beyond simple contact lists to medical and financial information that can be difficult to change or revoke.

What was likely exposed

The available facts state only that “internal files” were exfiltrated in a ransomware attack. No specific categories—such as patient charts, financial records, employee data or email archives—are named. Exact contents are therefore unconfirmed. Organizations of this type typically hold patient names, addresses, phone numbers, dates of birth, Social Security or insurance identifiers, medical and dental histories, treatment plans, appointment schedules, billing and payment information, and internal correspondence. Staff personnel files and operational documents may also exist on the same systems.

Because the facts do not enumerate the files, it is not possible to assert that any particular data type was or was not taken. Readers should assume that any information they supplied to the practice could theoretically be among the material claimed by the group, while recognizing that this remains an unverified possibility rather than an established inventory.

The real-world impact

For individuals, the primary risks are identity theft, medical-identity fraud and targeted social-engineering attacks. Stolen dental or medical records can be used to open fraudulent accounts, file false insurance claims or craft convincing phishing messages that reference real appointments or treatments. Contact details alone enable spam and scams; when combined with health information the messages become harder to dismiss. Because the number of people affected is unknown, anyone who has been a patient or employee of the practice has reason to monitor accounts and communications more closely.

For the organization, a ransomware claim can disrupt clinical operations, damage patient trust and trigger regulatory scrutiny under health-privacy rules. Even if systems are restored, the reputational and potential legal costs of an alleged data theft can persist. The absence of confirmed scale or published samples does not eliminate these risks; it simply leaves both the practice and its patients operating with incomplete information.

Were you affected?

If you have been a patient, family member or staff member associated with the practice, treat the claim as a prompt for practical steps rather than confirmed proof of compromise. Monitor bank, credit and insurance statements for unfamiliar activity. Be skeptical of unexpected emails, texts or calls that reference dental visits or personal details. Consider placing a fraud alert or credit freeze with the major credit bureaus if you believe sensitive identifiers may have been involved. Keep records of any communications you receive that appear related to the incident.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Such a scan will not confirm or deny involvement in this specific incident, but it can surface other exposures that warrant attention. Stay alert for any official notices from the practice itself; those remain the most direct source of guidance if further details emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.