The Foot Doctor Listed by spacebears Ransomware Group

On December 6, 2025, the ransomware group known as spacebears added The Foot Doctor, a podiatry clinic in Casper, Wyoming, to its public leak site, claiming that internal files had been exfiltrated from the medical practice.

What's Publicly Reported from Reporting

Public reporting indicates the clinic, operated by board-certified podiatrist Dr. Michael P. Wilkinson, treats ordinary patients seeking foot and ankle care. The spacebears leak page lists The Foot Doctor as a victim of a ransomware attack in which attackers exfiltrated internal files. Available reporting does not specify the exact number of patient records involved or the full list of data types exposed, though medical practices of this size typically hold names, contact details, dates of birth, insurance information, medical histories, and treatment records. No ransom demand deadline has been publicly detailed in connection with this specific listing.

Why This Matters for You and Your Family

When a local medical provider’s systems are breached, the information exposed is deeply personal. Medical records can reveal conditions, medications, and physical limitations that criminals can exploit for identity theft, insurance fraud, or targeted scams. Patient data from clinics like The Foot Doctor often includes home addresses, phone numbers, and email accounts—the same details attackers need to impersonate you or your family members. Even if you are not certain your records were included, the uncertainty itself creates stress. Families who visited the practice for routine care, sports injuries, or chronic pain relief now face the possibility that their private health information is in the hands of extortionists.

The Doxxing and Identity-Chain Implications

Medical breaches rarely stop at the initial leak. Attackers frequently combine exposed patient data with information from other sources to build detailed profiles. A phone number listed in a clinic file can be linked to social-media accounts, children’s school records, or online usernames. These connections create what security analysts call identity chains—pathways that allow criminals to move from one piece of information to many others. Credential leaks tied to medical portals or email accounts used for appointment scheduling can cascade into account takeovers across unrelated services. Public reporting shows that health-care data is especially valuable on underground markets because it combines sensitive personal details with financial and contact information, increasing the risk of long-term doxxing or harassment.

Spacebears’ Publicly Known Track Record

Public reporting attributes the spacebears ransomware group with emerging in recent years as a relatively new entrant in the ransomware ecosystem. The group typically gains initial access through common vectors such as phishing or exploited remote desktop protocols, exfiltrates data before encrypting systems, and then posts samples on its leak site to pressure victims into payment. Notable prior victims listed on similar ransomware leak platforms have included small-to-medium businesses and professional service providers. Their playbook follows a double-extortion model: demanding payment to prevent publication of stolen files while also threatening to sell or further distribute the data. Exact success rates and total victims remain difficult to verify, as many incidents go unreported.

What to do

• Run a DoxxScan to map every link between your email, phone number, medical-provider accounts, and real-world identity so you can see exactly what chains exist.
• Rotate any password you used when registering with The Foot Doctor or similar health portals, especially if that password appears anywhere else, and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into doxxing chains.
• Let remediation specialists handle the time-consuming work of submitting takedown requests to data brokers and monitoring sites that resell leaked medical or contact information.

The incident at The Foot Doctor illustrates how quickly a routine visit for foot pain can turn into a privacy headache for you and your family. Taking deliberate steps now limits what criminals can build from this breach and reduces the chance that today’s leaked medical file becomes tomorrow’s identity theft problem. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts—practical protection when credential leaks like this one spread into account takeovers and doxxing chains.