My New Jersey Dentist targeted by Rhysida ransomware group

• Ransomware group: Rhysida
• Country: United States
• Sector: Healthcare
• Announcement date: February 12, 2025

Rhysida claims data breach at My New Jersey Dentist

The Rhysida ransomware group has published a listing on its dedicated leak site, claiming responsibility for a data breach involving My New Jersey Dentist. According to the announcement made on February 12, 2025, the threat actor group claims to have exfiltrated a significant volume of information from the organization.

The group asserts that the stolen data totals approximately 965 GB in size. This massive cache of information is said to consist of 683,219 individual files. To support their claims, the threat actors have provided screenshots of various documents that are allegedly associated with the targeted organization, intended to demonstrate the validity of the breach.

Details of the claimed data exposure

The information allegedly released by the Rhysida group includes a wide variety of sensitive documents. Based on the screenshots provided in the leak site announcement, the data appears to contain highly sensitive administrative and personal records. The files reportedly include dental insurance plan information, Taxpayer Identification Numbers (TIN), various payment notifications, and various personal identification documents.

The specific types of data identified in the claim include:

• Patient health records
• Taxpayer information
• Payment information
• Personal identification documents

The exposure of such diverse datasets—ranging from medical-related insurance details to financial and identity documents—suggests a comprehensive compromise of the organization's digital environment.

About My New Jersey Dentist

My New Jersey Dentist is a dental clinic located in New Jersey. The organization provides general dental care services designed to serve families within the region.

Threat actor profile and potential impact

The Rhysida group is a known threat actor that has been active since 2023. The group is recognized for employing double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it, threatening to leak the sensitive information on public forums if a ransom is not paid. This tactic is frequently used to increase pressure on victims, particularly in sectors where data privacy is paramount.

The nature of the data allegedly leaked in this incident carries significant risks for the affected parties. The presence of personal identification and taxpayer information increases the risk of identity theft and the potential for targeted phishing attacks directed at both patients and employees. Furthermore, because the organization operates within the United States, this incident may result in legal and administrative sanctions under strict regulations designed to protect health data, such as the Health Insurance Portability and Accountability Act (HIPAA).

Beyond the legal implications, the public exposure of such sensitive information can lead to substantial reputational damage and a profound breach of trust between the clinic and its patient base. Given the established history and methods of the Rhysida group, it is considered likely that they will continue to employ similar tactics in future campaigns against various sectors.

In the broader context of cybersecurity, organizations in the healthcare sector often face these types of sophisticated threats. To defend against such risks, it is common practice for entities to implement robust security frameworks, including multi-factor authentication, regular data backups, and continuous monitoring of network traffic to detect unauthorized exfiltration. Protecting sensitive patient information remains a critical priority for healthcare providers to maintain operational integrity and patient safety.