ThreeAM ransomware group lists sequoiadental.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Sector: Healthcare
• Announcement date: May 1, 2026

The ThreeAM ransomware group has published a claim on its leak site involving the healthcare provider sequoiadental.com. According to the announcement, the group has listed the organization and claims to have made various file directories public, potentially exposing sensitive information belonging to the institution.

Details of the claimed attack

The ThreeAM group has listed sequoiadental.com on its leak site, claiming to have made various file directories public. The file names presented in the announcement suggest the potential exposure of the institution's operational processes and patient records. The group announced the publication of this data on June 26, 2025.

Ransomware attacks often involve a tactic known as double extortion, where threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak this data on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the disclosure of confidential files. The presence of a leak site announcement is a common method used by ransomware groups to demonstrate their ability to exfiltrate data and to increase the pressure on the target organization.

Potential data exposure and affected information

Based on the information provided in the announcement, the group has shared screenshots that display several specific folders. These folders include '3Shape', 'SDO-Hygiene1', 'Shared Documents', 'UserDocs', and 'VIVOS Patients'. The names of these directories suggest that sensitive dental patient records and administrative documents may have been compromised during the incident.

The specific types of data mentioned as potentially affected include:

• Patient records
• Administrative documents

While the specific volume of data or the exact number of files involved has not been disclosed, the folder names indicate a potential breach of both clinical and operational information. In such scenarios, organizations often face the challenge of determining the exact scope of the exfiltrated data to fulfill their regulatory obligations.

Organization profile

Sequoia Dental is a dental care center located in Visalia, California. The facility provides a wide range of services, including general dentistry, cosmetic dentistry, orthodontics, and restorative treatments.

Risk assessment and industry implications

This leak claim may carry the risk of exposing sensitive health data belonging to the institution's patients. As a healthcare provider operating in the United States, the incident may need to be evaluated under HIPAA regulations, which could potentially lead to legal consequences for the institution. Furthermore, the exposure of such data can lead to secondary risks for the affected individuals, such as identity theft and targeted phishing attacks.

In the healthcare sector, protecting sensitive patient information is a critical priority due to the high value of medical records on the dark web. When a breach occurs, organizations are often required to fulfill data breach notification obligations and inform the affected individuals to mitigate harm. For healthcare entities, maintaining robust security postures involves implementing strong access controls, continuous monitoring, and regular audits to protect against unauthorized access to patient records and administrative files.

Public information regarding the ThreeAM group remains limited. As with many emerging ransomware threats, the specific tactics, techniques, and procedures used by such groups may not be fully documented in public intelligence reports, making it difficult for organizations to proactively defend against their specific methods. Organizations in this sector typically focus on defensive strategies such as network segmentation, regular backups, and employee training to reduce the likelihood and impact of such incidents.