SPINE & DISC Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups have increasingly turned to healthcare providers as high-value targets, combining encryption with the threat of data leaks to pressure victims. In this landscape, the September 2021 listing of SPINE & DISC on a ransomware leak site illustrates how even specialized medical practices can find their internal records claimed as leverage in extortion campaigns. Public information remains limited, yet the incident underscores the exposure risks tied to organizations that handle sensitive patient and operational records.

Inside the incident

On September 09, 2021, SPINE & DISC appeared on the leak site operated by the Avaddon ransomware group. The listing indicated that internal files had been exfiltrated during a ransomware attack. No confirmed count of affected individuals has been released, and the precise volume or nature of the files has not been disclosed publicly. The group claims to have stolen internal data, but independent verification of the exfiltration or its contents has not been reported.

The group behind it: avaddon

Avaddon operated as a ransomware-as-a-service affiliate model, encrypting victim systems and maintaining a public leak site to publish data from organizations that refused ransom demands. The group’s typical approach involved double-extortion tactics, where encryption was paired with the threat of releasing stolen files. Avaddon was publicly active through 2021 before its infrastructure was disrupted later that year. In this case the listing of SPINE & DISC constitutes the group’s claim of possession; no additional confirmation from the victim or law-enforcement sources has been made public.

SPINE & DISC and its sector

SPINE & DISC functions as a medical practice focused on spinal and disc-related care. Organizations in this sector routinely maintain electronic health records, imaging studies, insurance and billing information, and internal administrative files. A breach at such a facility is consequential because healthcare data often includes identifiers that can be misused for identity theft or insurance fraud, and because regulatory frameworks require notification and protection of patient information even when exact exposure details remain limited.

What data was at risk

The only detail released is that internal files were allegedly exfiltrated. Specific data types have not been confirmed. Organizations of this kind commonly store patient identifiers, clinical notes, diagnostic images, and financial records, yet it is not possible to state which categories, if any, were actually taken.

What's at stake

Individuals whose records may have been involved face the possibility of long-term misuse of personal and medical information. For the organization, the incident adds operational disruption, potential regulatory scrutiny, and the need to assess whether further notification or remediation steps are required. Because the scale of exposure remains unknown, the full extent of these consequences cannot yet be measured.

What to do if you're exposed

Anyone who suspects their information may have been involved should begin with basic protective measures while awaiting any official notification from the provider.

• Review account statements and explanation-of-benefits notices for unusual activity.
• Place a fraud alert or credit freeze with major credit bureaus if financial details could be affected.
• Run a free exposure scan of your email address against known breach data to check for additional appearances.
• Keep records of any correspondence from SPINE & DISC and contact them directly for information on their response.

AICompiled with AI assistance from public sources and published under our editorial standards.