A ransomware group operating under the name Wallstreet has posted a claim on its dark web leak site stating that it targeted On Demand Occupational Medicine, with the listing dated September 10, 2026. This claim was identified by ransomware.live, a security research platform that continuously monitors the public-facing leak sites operated by ransomware groups. At this stage, the claim reflects only what the group itself has posted — it has not been verified by On Demand Occupational Medicine, by any independent security firm, or by any regulatory body.
What we currently know versus what remains unconfirmed
- The claimed date of the incident, as posted by the group, is September 10, 2026.
- On Demand Occupational Medicine operates in the healthcare sector, providing occupational medical services.
- The Wallstreet group has not published, and BreachLetter has not been given, any specifics about what data types may have supposedly been accessed.
- No record counts, file samples, or technical details beyond the existence of the leak-site listing have been disclosed at this time.
- The company has not issued any public statement confirming or denying that an incident occurred.
Precautions worth considering while this claim is unresolved
- Change passwords for any accounts associated with On Demand Occupational Medicine or related patient portals, especially if credentials are reused elsewhere.
- Turn on two-factor authentication wherever it is offered, particularly for email, financial, and healthcare-related accounts.
- Stay alert to phishing emails, calls, or texts that reference medical appointments, billing, or occupational health screenings, as these are common tactics following claimed breaches.
- Consider ongoing identity monitoring services such as a service like Aura or LifeLock to get alerted early if personal information turns up somewhere it shouldn’t be.
- Keep an eye on medical billing statements and insurance explanations of benefits for anything unfamiliar.
BreachLetter will revisit and update this article should On Demand Occupational Medicine confirm any part of this claim, or if the incident is formally disclosed to regulators or affected individuals.