On August 24, 2023, medical-records retrieval company Ontellus appeared on the leak site of the BlackByte ransomware group. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of records affected and the specific data types inside those files remain undisclosed by both the threat actor and the company.
Watch Ontellus
Get alerted the next time Ontellus files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Ontellus’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details in the BlackByte Listing
The primary disclosure on the BlackByte leak site, archived via ransomware.live, states that Ontellus was listed after the company apparently declined or failed to meet the group’s extortion demands. The entry notes that internal files were allegedly exfiltrated but provides no sample data, no victim count, and no deadline for publication. Ontellus, founded in 1975 and rebranded in 2017, supplies internet-based record retrieval and billing services to healthcare organizations, insurance carriers, and law firms. Its headquarters sit in Houston, Texas. No separate breach notification or regulatory filing from Ontellus has surfaced publicly, leaving the full scope of the exposure unknown.
Why This Matters for You and Your Family
When a records-retrieval firm like Ontellus loses control of internal files, the information inside often includes names, addresses, dates of birth, Social Security numbers, medical records, insurance details, and billing data belonging to ordinary patients and their families. Even though the BlackByte listing does not quantify affected records, any single exposed document can contain enough personal data to fuel identity theft, insurance fraud, or targeted phishing. If you or a family member have ever been involved in a personal-injury claim, workers’ compensation case, or civil litigation that required medical-record retrieval, your information may now sit in an attacker’s archive.
Doxxing and Identity-Chain Risks
Medical and billing files frequently link an individual’s real identity to email addresses, phone numbers, employer details, and sometimes login credentials used across other services. Attackers routinely chain these pieces together: a leaked email and password from one breach grants access to a healthcare portal, which yields more documents, which surface new addresses or family-member names. The result is a growing digital dossier that can be sold, used for extortion, or weaponized to hijack accounts. Credential leaks of this nature also cascade into gaming platforms; children’s usernames, shared family emails, or reused passwords can lead to account takeovers that expose chat logs, location data, and additional personal details.