Nationwidecare.org listed on teamxxx leak site

• Ransomware group: teamxxx
• Country: United Kingdom
• Sector: Healthcare
• Announcement date: June 25, 2025

The threat actor known as teamxxx has published a claim on its leak site involving the organization Nationwidecare.org. According to the announcement, the group has gained unauthorized access to the organization's systems and has listed the entity on its platform, claiming that various data sets belonging to the organization have been compromised.

Details of the claimed attack

The threat actor known as teamxxx claims to have gained access to various file directories within the systems of Nationwidecare.org. This claim was made by listing the organization on the group's dedicated leak site. According to the information provided by the group, the breach is linked to files that were observed to have been created on April 29, 2025. The announcement regarding this data leak was officially posted on the group's leak site on June 25, 2025.

The evidence provided by the threat actor includes screenshots that appear to show the presence of specific compressed archive files within the compromised directories. These screenshots are used by the group to support their claim of unauthorized access to the organization's internal file structures.

Data involved in the leak

Based on the screenshots provided by the teamxxx group, the leaked information appears to be contained within compressed archive files (zip). The group has highlighted specific files that are intended to represent the stolen information. These files include:

• Corporate data
• Employee data

The naming conventions of the files shown in the screenshots, specifically 'corp-data-pl.zip' and 'employee.zip', suggest that the archives contain sensitive corporate information as well as data pertaining to the organization's staff. No specific information was provided regarding the total size of the data or the exact number of files contained within these archives. Additionally, there was no information provided regarding a specific ransom demand.

Impact and organizational risks

The claim of a data leak poses significant risks to the operations and the employees of Nationwidecare.org, which operates within the healthcare sector. Because the leaked data is claimed to include employee information, there are potential secondary risks for the affected individuals, such as the possibility of identity theft and the threat of targeted phishing attacks.

In the United Kingdom, the exposure of such data may trigger legal obligations under the UK GDPR, which is the data protection legislation governing the United Kingdom. The nature of the data involved suggests that the organization may need to review its existing data security processes and may be required to notify the affected parties regarding the incident.

General context of ransomware extortion

This incident follows a pattern often observed in modern cyberattacks where threat actors utilize a double extortion method. In such scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish the stolen data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of sensitive information.

For organizations operating in critical sectors like healthcare, these types of leaks are particularly damaging due to the sensitive nature of the data handled. Defensive measures for organizations typically involve implementing robust data security protocols, maintaining regular backups, and ensuring strict compliance with regional data protection regulations to mitigate the impact of potential exfiltration.