ThreeAM ransomware group lists austinplasticandreconstructivesurgery.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Sector: Healthcare
• Announcement date: May 1, 2026

The ThreeAM ransomware group has published data on its leak site that it claims belongs to Austin Plastic Reconstructive Surgery. This announcement, which appeared on the group's platform, marks a potential data breach involving a healthcare provider located in the United States.

The claimed attack and event details

According to the claims made by the threat actor known as ThreeAM, the organization was listed on their leak site on August 8, 2025. The group asserts that they have made various files and name lists public that allegedly belong to the institution. While the announcement was officially posted on the leak site on May 1, 2026, the group suggests that the data involved in this incident was obtained on August 7, 2025.

Information regarding this specific threat actor remains limited in the public domain. In many modern cyberattacks, ransomware groups utilize a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat actors then threaten to leak this stolen information on public forums or dedicated leak sites if the ransom demands are not met. This strategy places immense pressure on organizations due to the potential for regulatory scrutiny and reputational damage.

Data and information involved

The details provided in the announcement regarding the specific contents of the breach are limited. While screenshots associated with the leak appear to display lists that seem to contain patient names and various file names, the full scope and the exact nature of the leaked data have not been detailed. No information was provided regarding the total size of the data or the specific count of files involved in the breach. Furthermore, no ransom demand has been disclosed in the current announcement.

The data types identified in the listing include:

• Patient names
• File records

Organization profile

Austin Plastic Reconstructive Surgery is a healthcare clinic led by Dr. Christine Fisher. The facility specializes in breast reconstruction and a variety of cosmetic surgery procedures.

Impact assessment and industry implications

This potential leak may compromise the patient privacy of the healthcare institution. For organizations operating within the healthcare sector, such breaches can lead to significant legal processes under HIPAA regulations. The exposure of sensitive information increases the risk of patients being subjected to identity theft or targeted phishing attacks, where attackers use stolen details to conduct more convincing fraudulent communications.

The incident could result in substantial reputational damage and cause disruptions to the institution's operational processes. When such breaches occur, organizations often find it necessary to inform their patients about the potential exposure and conduct a thorough review of their security measures to prevent future occurrences. Common defensive steps for organizations in the healthcare sector often include implementing robust encryption, enforcing multi-factor authentication, and maintaining rigorous access controls to protect sensitive patient information from unauthorized exfiltration.