Interlock Claims Theft of 150K+ Patient SSNs from Oklahoma Practice
The Interlock ransomware group listed Southwest Orthopaedic & Reconstructive Specialists, an orthopaedic practice in the Oklahoma City area, on its leak site, claiming databases with more than 150,000 Social Security numbers linked to patient names and addresses, plus medical records and billing data. No samples have been verified and the practice has not confirmed an incident. If genuine, the case triggers HIPAA and Oklahoma breach-notification duties and demands immediate response.
What happened
The Interlock ransomware group listed Southwest Orthopaedic & Reconstructive Specialists, an orthopaedic practice in the Oklahoma City area, on its leak site. The group claims databases with more than 150,000 patient Social Security numbers linked to names and addresses, plus medical records and billing data. The practice has not confirmed an incident and no samples have been verified.
Why it matters
If genuine, patients face identity theft and medical fraud risk, and the practice faces HIPAA and Oklahoma breach-notification duties. The group says it is leaking the data because the practice refused to resolve the incident. Public exposure may drive loss of patient trust and regulatory action.
What to do
Activate the incident response plan and investigate signs of intrusion and data exfiltration. Engage legal and compliance to assess HIPAA and Oklahoma notification deadlines. Prepare patient communication and credit monitoring if the breach is confirmed.
For the technical team
- Affected
- Southwest Orthopaedic & Reconstructive Specialists, clínica de cirurgia ortopédica com unidades na região de Oklahoma Ci · Southwest Orthopaedic & Reconstructive Specialists, an orthopaedic surgery practice with clinics across the Oklahoma City area. Affected systems not specified in the source.
- Exploitation
- Ransomware group claim, with no independent verification. No samples verified and the victim has not confirmed an incident. Reported by DailyDarkWeb.
- Fix
- Not applicable to a data breach. No software fix cited in the source.
- Vector
- Access method not described in the source. According to DailyDarkWeb, Interlock pairs encryption with data theft. Initial vector unknown.
- More details
- The group says it is leaking the data because the practice refused to resolve the incident. According to DailyDarkWeb, Interlock has repeatedly hit US healthcare providers. This case is separate from the practice's 2024 notice about a third-party (INTEGRIS Health) incident. If genuine, it triggers HIPAA and Oklahoma breach-notification duties.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
