US Dermatology Partners Listed by bianlian Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare providers across the United States, exploiting the sector’s reliance on digital records and the high value of patient and operational data. In this environment, listings on criminal leak sites have become a common way for attackers to pressure organisations after claiming to steal files. On 19 June 2024, the ransomware group known as bianlian publicly listed US Dermatology Partners, asserting that it had exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and further technical details have not been disclosed.

Such claims matter because dermatology practices hold sensitive clinical and administrative information. Even when the precise contents of stolen data stay unconfirmed, the mere assertion of a breach can create lasting uncertainty for patients and staff. This article sets out only what is known from the public record and places the incident in context without speculation.

What happened

According to the available record, US Dermatology Partners was listed by the bianlian ransomware group on 19 June 2024. The group claims that internal files were exfiltrated during a ransomware attack. No public confirmation of the attack’s success, the method of intrusion, the duration of access, or the volume of data taken has been released. The number of individuals potentially affected is listed as unknown. Beyond the group’s leak-site claim, no additional technical indicators or official statements detailing the incident timeline have been provided in the source material.

The group behind it: bianlian

Bianlian is a ransomware operation that has been active for several years and is known for double-extortion tactics: encrypting systems while simultaneously stealing data and threatening to publish it if a ransom is not paid. The group typically gains initial access through phishing, compromised credentials, or exploitation of remote-access services, then moves laterally to locate valuable files before deploying ransomware. Public reporting has documented bianlian’s focus on mid-sized organisations across healthcare, manufacturing and professional services, often listing victims on its dark-web leak site to increase pressure. In this case the group claims to have taken internal files from US Dermatology Partners; that claim has not been independently verified in the available facts, and no specific ransom demand or sample files tied to this victim have been described beyond the listing itself.

Who is US Dermatology Partners?

US Dermatology Partners is a physician-owned dermatology practice that operates a coordinated care network offering general medical, surgical and cosmetic skin treatment. Organisations of this type routinely manage electronic health records, appointment systems, billing information and staff credentials. Because dermatology practices sit at the intersection of clinical care and personal health data, a successful ransomware incident can disrupt patient appointments, delay treatment and expose information that patients expect to remain confidential. The scale of the practice’s network means any confirmed compromise could affect multiple locations and a large patient base, though the exact footprint of this incident remains undisclosed.

What data was at risk

The only data type named in the public record is “internal files” said to have been exfiltrated in the ransomware attack. No further breakdown—such as patient names, medical histories, Social Security numbers, financial records or employee data—has been confirmed. Healthcare organisations of this kind typically store protected health information, insurance details, contact data and operational documents. Because the precise contents of the claimed exfiltration have not been disclosed, it is not possible to state which categories were actually taken. Readers should treat any assertion of specific data types beyond “internal files” as unconfirmed.

The real-world impact

For patients and staff, the primary risk is the potential misuse of any personal or clinical information that may have been stolen. Even without confirmed identity-theft cases, the uncertainty can lead to heightened vigilance around medical identity fraud, phishing attempts that reference the practice, and long-term monitoring of credit and health records. For the organisation, a ransomware listing can interrupt clinical operations, require costly system restoration, and trigger regulatory notification obligations under HIPAA if protected health information is later verified as compromised. Reputational damage and the administrative burden of investigating the claim also follow, regardless of whether a ransom is paid. Because the number of affected individuals is unknown and the exact data set remains undisclosed, the full scope of harm cannot yet be measured.

What to do if you're exposed

If you are a patient or employee of US Dermatology Partners, begin by monitoring account statements, credit reports and any unexpected medical bills for signs of misuse. Place a free fraud alert with the major credit bureaus and consider freezing your credit if you notice irregularities. Review emails carefully for phishing messages that reference the practice or request personal information. Change passwords on any accounts that may have shared credentials with the organisation, and enable multi-factor authentication wherever possible. Finally, you can run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets; this provides an early indicator without cost or commitment.

AICompiled with AI assistance from public sources and published under our editorial standards.