The Direwolf extortion gang added two more healthcare targets to its leak site this week, listing telehealth platform Leafwell and nurse staffing firm Health Carousel.
Trackers logged the Health Carousel entry on August 10 and the Leafwell listing on August 11, with ransomware.live and RansomLook both recording the claims. The listings came in the same stretch as the gang’s entries for ECG device maker AliveCor and Spanish hospital group Quironsalud, which the tracker community reported earlier in the week.
Leafwell provides telehealth services for medical cannabis patients, meaning any stolen files could contain consultation records and personal health details. Health Carousel, an Ohio-based healthcare staffing company that places nurses with hospitals across the United States, holds employment records, credentialing documentation, and identity information for clinicians.
Neither company has confirmed the claims, and ransomware groups routinely exaggerate or fabricate victim lists. But staffing firms are a sensitive target because they sit between large provider networks and the workforce, and a data theft there can expose the personal information of hundreds of nurses at once.
Healthcare organizations that work with either company should confirm the exposure with their contacts, review credentialing data handling, and watch for phishing that uses the breach claims as a lure. Hospitals that have nurses placed through Health Carousel should ask about the scope of the incident.
