A ransomware group operating under the name DragonForce has posted a claim on its dark web leak site asserting that it obtained data from Medical Department Store, with the posting dated September 10, 2026. This claim comes solely from the group’s own extortion listing, which has been tracked and logged by ransomware.live, a security research platform that monitors ransomware leak sites. At this stage, the claim is unverified, and neither Medical Department Store nor any regulatory body has confirmed that an incident took place.
What has surfaced so far, and where the gaps remain
- The claimed date of the posting is September 10, 2026.
- Medical Department Store operates within the healthcare sector, which frequently handles sensitive patient and operational records, though this alone does not establish what, if anything, was accessed.
- DragonForce has not disclosed the specific categories of data it claims to hold, and no file samples, screenshots, or detailed descriptions have been independently verified.
- No official statement from Medical Department Store or confirmation to data protection regulators has been identified at the time of writing.
Precautions worth considering while this claim remains unresolved
- Update passwords tied to accounts associated with Medical Department Store, particularly if credentials are reused elsewhere.
- Turn on two-factor authentication wherever it is offered, adding a second layer of protection beyond a password alone.
- Stay alert for phishing attempts, especially messages referencing healthcare services, appointments, or account verification that pressure quick action.
- Consider signing up for a service like a service like Aura or LifeLock to monitor for signs of identity misuse tied to your personal information.
- Review account statements and medical billing summaries periodically for unfamiliar activity.
BreachLetter will revisit and update this article if Medical Department Store issues a public statement, confirms an incident, or if the matter is reported to relevant data protection regulators.