SF Smile Doctor Listed by CRPxO Ransomware Group: What Was Exposed & What To Do
SF Smile Doctor was listed by the CRPxO ransomware group on July 09, 2026, after internal files were exfiltrated in a ransomware attack. Individuals who may have been patients or staff should check for breach notices and change any exposed credentials.
Breaking down the breach
The only details released so far come from the group’s listing. It reports that files were taken during a ransomware operation and that the total volume reached 100 GB. No date of the intrusion, method of access, or confirmation that data was published has been provided. The number of people affected is listed as unknown.
Who is CRPxO?
CRPxO is a ransomware group that publicly lists organizations it claims to have targeted. Like other groups of this type, it typically exfiltrates data before or during encryption and uses a leak site to pressure victims. The listing of SF Smile Doctor constitutes the group’s claim; independent verification of the data volume or its contents has not been reported.
SF Smile Doctor and its sector
SF Smile Doctor operates in the medical sector as a dental practice. Organizations in this field routinely collect and store patient records, appointment information, billing details, and identification data required for treatment and insurance processing. A breach involving such an organization raises the possibility that sensitive personal and health-related information could be exposed, though the precise scope in this case remains unconfirmed.
The information in question
The listing describes the material as internal files totaling 100 GB. No inventory of specific data categories has been released. Medical practices commonly hold patient names, dates of birth, contact information, medical histories, treatment notes, insurance details, and financial records. Whether any or all of these types are present in the exfiltrated files cannot be determined from the information currently available.
What's at stake
Individuals whose records may be involved face the possibility of identity misuse or targeted fraud if personal or financial details are among the files. Health-related information, if present, could also be used for targeted scams or sold on underground markets. For the organization, the incident adds operational disruption, potential regulatory scrutiny, and the cost of response measures, regardless of whether the data is later verified as published.
Were you affected?
Begin by monitoring statements from SF Smile Doctor for any official notification. Review financial accounts and insurance statements for unusual activity. Individuals can also check whether their email address appears in known breach datasets through publicly available exposure scanning tools. If contacted by the practice, follow any instructions provided for credit monitoring or identity protection services.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Elko Dental Specialists Listed by CRPxO Ransomware GroupDignity Phoenix Listed by CRPxO Ransomware GroupLeah Walker Orthodontics Listed by CRPxO Ransomware GroupeCare Platform Listed by CRPxO Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the SF Smile Doctor Listed by CRPxO Ransomware Group →
Publicly posted by crpxo — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.