Encompass Group Listed by Royal Ransomware Group

On April 21, 2023, medical supply manufacturer Encompass Group appeared on the leak site of the Royal Ransomware group. The listing states that attackers exfiltrated 47 GB of internal files during a ransomware incident and threatens to publish employee passports, Social Security numbers, NDAs, contracts, and confidential agreements.

Details in the Leak-Site Listing

The Royal Ransomware leak page explicitly names Encompass Group, a company founded in 1999 and based in McDonough, Georgia, that produces reusable textiles, professional apparel, and single-use medical products. It claims the stolen data includes employee passports, Social Security numbers, a large number of NDAs, contracts, and other confidential agreements. The posting does not specify the total number of individuals affected and does not list every file type taken. Attackers say they will release samples and additional material soon. No ransom amount or payment deadline appears in the public listing.

Why This Incident Matters for You and Your Family

When a company that handles medical products and employs hundreds of people loses control of personal documents, the risk lands directly on employees, contractors, and their households. SSNs and passports are high-value identity documents that can be used to open accounts, file fraudulent tax returns, or obtain government benefits in your name. Even if you never worked at Encompass, family members or dependents whose records were stored in shared vendor files can be exposed. The breach turns private employment paperwork into public ammunition for identity thieves who rarely limit themselves to one victim.

Doxxing and Identity-Chain Risks

Leaked passports and NDAs frequently contain home addresses, dates of birth, and signatures that link easily to social-media profiles, children’s school records, and gaming usernames. Once attackers or opportunistic criminals chain an email address from an NDA to a reused password, they can move from corporate files to personal accounts within hours. This is exactly how employee breaches cascade into family doxxing: one stolen document exposes the household address, which then surfaces in children’s gaming accounts or parent-teacher portals. The Royal listing makes these connections cheaper and faster for anyone monitoring the leak site.

Royal Ransomware’s Known Track Record

Public reporting attributes Royal Ransomware’s emergence to late 2022. The group has targeted healthcare, manufacturing, and professional-services organizations, often listing victims on its onion site after double-extortion attempts. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of sensitive files before encryption. Royal then posts samples on its leak portal and pressures victims with threats of full data release. The group does not always publish every claimed gigabyte, but the pattern of releasing employee personal documents has appeared in multiple prior incidents.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate any password you used at Encompass Group or any vendor tied to it, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same leaked address or parent email.
• Let remediation specialists manage takedown requests for any exposed documents or broker listings that appear after this leak.

The exposure of passports and SSNs from a single manufacturing breach shows how quickly corporate data becomes personal liability. Staying ahead requires more than checking one site; it demands ongoing visibility and expert help. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one.