Cactus ransomware group lists quigleyeye.com on its leak site

• Ransomware group: Cactus
• Country: United States
• Sector: Healthcare
• Announcement date: March 3, 2025

Cactus ransomware group claims data theft from Quigley Eye Specialists

The Cactus ransomware group has listed a significant amount of data on its leak site, claiming the information belongs to Quigley Eye Specialists. According to the announcement made on March 3, 2025, the group alleges they have exfiltrated 435 GB of data from the healthcare provider. This claim follows a pattern of double-extortion tactics commonly utilized by modern ransomware groups, where stolen data is used as leverage to pressure victims into paying a ransom.

Details of the alleged breach

On March 3, 2025, the Cactus group announced that it had successfully compromised Quigley Eye Specialists and obtained sensitive information. The group claims to have infiltrated the institution's networks to exfiltrate internal files. To support their claims, the attackers provided sample documents that appear to contain both operational and patient-related information.

The leaked samples provided by the group include various sensitive items, such as passports, driver's licenses, background check forms, and detailed patient examination reports. This type of exposure highlights the high value that cybercriminals place on medical and personal identification documents, which can be used for various fraudulent activities.

Data types involved in the claim

• Patient medical records
• Employee personal data
• Financial documents
• Corporate internal correspondence

About Quigley Eye Specialists

Quigley Eye Specialists is a Florida-based eye care and surgical practice. They provide medical services specializing in the diagnosis and treatment of vision disorders such as cataracts, glaucoma, and corneal conditions.

Implications and potential risks

The alleged breach poses a direct threat to patient privacy and the operational security of a healthcare provider. The provided samples suggest that the institution may face challenges regarding compliance with data protection regulations such as HIPAA. The nature of the exposed data could lead to secondary risks for affected individuals, including identity theft and targeted phishing attacks.

Given the Cactus group's known double-extortion tactics, it is possible that the full dataset will be published if ransom demands remain unmet. In such scenarios, organizations often face the difficult task of managing public disclosure and fulfilling legal obligations. The institution may be required to fulfill data breach notification obligations and inform all affected parties regarding the exposure of their sensitive information.

In the broader context of cybersecurity, healthcare organizations are frequent targets due to the sensitive nature of the data they manage. When a breach occurs, organizations typically focus on incident response, which includes containing the threat, investigating the extent of the infiltration, and assessing the impact on both patients and operations. Defensive measures for organizations in this sector often involve implementing robust access controls, continuous monitoring of network traffic, and ensuring that all systems are patched against known vulnerabilities to prevent unauthorized access.