ThreeAM ransomware group lists dbhcares.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Sector: Healthcare
• Announcement date: May 25, 2025

ThreeAM claims data breach at Desert Behavioral Health

The threat actor known as ThreeAM has listed the entity operating under the domain dbhcares.com on its leak site, alleging a significant data breach. This announcement, which was made public through a post published on May 25, 2025, suggests that the organization's digital infrastructure has been compromised. While the group has claimed responsibility for the incident, the claims remain unverified by independent sources.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information on public forums if a ransom is not met. This tactic is designed to maximize pressure on the victim by threatening their reputation and regulatory standing. The use of such sites has become a common method for cybercriminals to exert leverage over their targets.

Details of the alleged compromise

According to the announcement made by ThreeAM, various file directories related to the institution's operations have been compromised. The group's claims indicate that the breach involves a range of internal documentation. Based on screenshots provided by the threat actor, the compromised directories include several sensitive categories of information.

The specific types of data mentioned in the listing include:

• Patient referral forms
• Attendance records
• Billing data
• Business records
• Cash records

The presence of these specific directories suggests that the attackers may have gained access to administrative and financial workflows. Such access typically allows threat actors to navigate through various levels of an organization's file system, potentially uncovering sensitive information that is critical to both patient care and business operations.

About Desert Behavioral Health

Desert Behavioral Health (DBH) is a healthcare organization founded in 2009. The institution provides bio-psycho-social integrated mental health services to outpatients located in Southern Nevada. Given its role in providing mental health services, the organization handles sensitive information related to patient wellness and psychological health.

Potential impact and industry implications

This alleged breach may pose a risk of exposing sensitive patient and operational data for an institution operating in the healthcare sector. Because the entity is based in the United States, a potential data breach could lead to legal proceedings and administrative sanctions under HIPAA regulations. Healthcare organizations are subject to strict privacy standards, and any compromise of protected health information can result in significant regulatory scrutiny.

The exposed data, which includes billing and personal records, may create secondary risks such as identity theft or targeted phishing attacks for patients and employees. When personal identifiers or financial records are leaked, individuals become targets for social engineering attacks where criminals impersonate legitimate entities to steal further information.

While public information regarding the ThreeAM group is limited, the group's methods may negatively impact the institution's operational continuity and reputation. For organizations in the healthcare sector, maintaining robust defensive measures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to mitigate the risk of initial access through phishing or other common vectors.