RansomHub ransomware group lists molars.co.ke on its leak site

• Ransomware group: RansomHub
• Country: Kenya
• Sector: Healthcare
• Announcement date: January 6, 2025

RansomHub claims data breach at molars.co.ke

The RansomHub ransomware group has published a listing on its dedicated leak site claiming that it has stolen data belonging to molars.co.ke. This announcement, which appeared on January 6, 2025, suggests a significant breach of information belonging to the Kenyan dental clinic. While the group has claimed responsibility for the attack, the details provided in the announcement focus on the types of files they have allegedly made public.

Ransomware leak sites are a common tool used by cybercriminal groups to exert pressure on victims. In many cases, these groups employ a tactic known as double extortion. In a double extortion scenario, attackers do not just encrypt an organization's data to disrupt operations; they also steal sensitive information and threaten to release it publicly if a ransom is not paid. This tactic increases the leverage of the attackers, as the threat of a data leak can cause significant reputational damage and legal liabilities for the victim organization.

Details of the alleged leak

According to the claim made by RansomHub on January 6, 2025, the group has made various files belonging to the institution public. The announcement included sample files to demonstrate the validity of the breach. The information allegedly exfiltrated by the group includes sensitive corporate and personal documentation. The specific types of data mentioned in the claim include:

• Employee salary information
• Personal identification documents
• Corporate documents

The presence of such diverse data types suggests that the attackers may have gained access to internal administrative systems. The inclusion of passport copies and salary structures indicates that the breach extends beyond mere operational files and into highly sensitive personal and financial information.

About molars.co.ke

Molars is a dental clinic based in Nairobi, Kenya. The organization provides general dentistry and oral healthcare services to its patient base. As a provider in the healthcare sector, the clinic handles sensitive medical and personal information as part of its daily operations.

Implications and security considerations

This leak may lead to the exposure of personal data belonging to the institution's employees and potentially its patients. The publication of sensitive identity information, such as passports, may create a high risk of identity theft for the affected individuals. Because the institution operates within the healthcare sector, the leak may result in legal consequences under Kenya's data protection regulations.

RansomHub is known as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024 and reportedly absorbed affiliates after ALPHV. Although it has been reported that the group ceased operations in early 2025, such leaks may pave the way for secondary phishing attacks. In these secondary attacks, criminals use the stolen information to craft highly convincing fraudulent communications to trick individuals into revealing even more sensitive data or funds.

For organizations operating in the healthcare sector, protecting sensitive data is a critical priority. Defensive measures typically include implementing robust access controls, ensuring regular backups are stored offline, and maintaining rigorous patch management to close vulnerabilities. Furthermore, organizations should monitor for signs of unauthorized data exfiltration and implement multi-factor authentication to protect administrative accounts. Given the potential for identity theft following such leaks, individuals affected by these types of breaches should remain vigilant against phishing attempts and monitor their financial and personal accounts for suspicious activity.