drcloudemr.com listed on Safepay ransomware leak site

• Ransomware group: Safepay
• Country: United States
• Sector: Healthcare
• Announcement date: September 17, 2025

The threat group known as Safepay has listed the healthcare technology provider drcloudemr.com on its dedicated leak site. This announcement, posted on September 17, 2025, follows a claimed attack date of August 14, 2025. The listing serves as a public claim by the threat actors regarding their involvement with the organization's systems.

Details of the claimed attack

According to the announcement published by Safepay, the group claims to have successfully compromised the systems of drcloudemr.com. The post made by the threat actor includes various details concerning the company's business operations and its revenue status. This type of information is often used by ransomware groups to exert pressure on a target during negotiations.

Ransomware leak sites function as a platform for cybercriminals to host lists of victim organizations. These sites are used to shame companies into paying ransoms by threatening to release sensitive information. The presence of a company on such a site indicates that the group is actively pursuing the target through public exposure.

Data involved in the incident

Regarding the specific content of the alleged breach, the announcement provides no specific information regarding the type or content of the data allegedly leaked. The listing does not specify the volume of files or the exact nature of the information that the group claims to have acquired.

About drcloudemr.com

DrCloudEHR is a technology company that provides cloud-based electronic health record (EHR) and practice management software for ambulatory clinics and healthcare organizations. It offers solutions that help healthcare providers manage patient data and digitize clinical workflows.

Risk assessment and industry implications

Given the double extortion tactics employed by the Safepay group, there may be a risk of sensitive data being published. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method increases the leverage held by the attackers, as the victim faces both operational downtime and the threat of a data breach.

As the organization operates in the healthcare sector, a potential data breach could lead to legal consequences under regulations such as HIPAA. The exposure of electronic health records could result in secondary risks, including identity theft and targeted phishing attacks. Because the group emerged in late 2024, their operational methods may continue to evolve, potentially expanding the impact on the organization's supply chain.

Organizations operating in the healthcare sector often face heightened risks due to the high value of medical data on the dark web. To mitigate these risks, companies typically implement multi-factor authentication, conduct regular security audits, and ensure robust encryption for data at rest and in transit. Maintaining a comprehensive incident response plan is also a critical defensive step to manage the potential fallout of a breach, including regulatory compliance and communication with affected parties.