On June 10 2025 , the Everest ransomware group added Avantic Medical Lab – a diagnostic services provider headquartered in Edison New Jersey – to its dark web leak site. By July 3-4 the group published what it claimed was 31-33 GB of internal files , including sensitive patient data. Despite the exposure Avantic has not publicly confirmed the incident and no entry for the lab appears on the U.S. Department of Health and Human Services’ HIPAA breach portal as of this writing. What was stolen , Leaked archives reportedly contained:

Patient names addresses phone numbers and dates of birth Social Security numbers and other government identifiers Laboratory results diagnoses and physician notes Health insurance and billing records Payment card and check images in some cases The breadth of data indicates compromise of both clinical and administrative systems raising risk of identity theft alongside exposure of protected health information (PHI). How the intruders got in Everest did not disclose its intrusion method. No forensic report has been released by Avantic. Based on patterns in other Everest campaigns researchers suspect initial access was gained through stolen VPN or remote-desktop credentials followed by lateral movement into file servers containing patient records. Without confirmation the vector remains speculative. , Scope by the numbers

31-33 GB of files posted publicly Dataset includes tens of thousands of patient records (exact count not yet confirmed) Exposure spans medical financial and insurance data, categories

Immediate fallout Security researchers flagged the leak within days noting the combination of clinical test results and Social Security numbers is unusually toxic for victims. While consumer credit data can be changed lab histories cannot – making the Avantic breach especially sensitive. Some files reviewed by analysts included explanation-of-benefits (EOB) forms and payment records which could be misused for insurance fraud. The inclusion of lab test results also increases risks of stigma or discrimination if data circulates publicly. Company response As of late September 2025 Avantic has not issued a breach notification to patients or regulators. Its public website contains only a generic HIPAA Privacy Notice . That silence has drawn criticism from privacy advocates who argue affected patients have been left in the dark. Ongoing significance The Avantic case illustrates how ransomware crews continue to target healthcare providers for their rich PHI stores. Unlike retail or entertainment breaches the exposure here spans irreversible health data amplifying harm beyond credit monitoring. Regulators and class-action attorneys are watching closely. Unless Avantic acknowledges the incident and begins notification, patients may only learn of their exposure through underground dumps and media reports.