A relatively new extortion crew is posting healthcare victims with something most leak sites skip: an itemized inventory of exactly what it says it took.
N0n listed EnVision Eye Care, a Mississippi ophthalmology practice, on October 16. The writeup claims 13,308 patient records with names and dates of birth from a December 2025 database backup, the practice’s full backup history from 2018 through 2025, examination records carrying ocular and medical history, and the complete OCT scan archive.
A day earlier the same group posted Evolution Spine / All Labs, a Texas spinal implant manufacturer, claiming FDA quality system records: corrective actions, device history records for implant lots, design drawings, and audit files. It also claimed a 317-table inventory database with hospital customer names, purchase orders, and implant lot shipping records.
Device makers are the softer target
Implant firms sit upstream of every hospital that buys their hardware, which is why FDA quality records are the valuable material. Those files carry design specifications, manufacturing tolerances, and audit trails. Leaking them is a competitive and regulatory weapon as much as a privacy one.
The inventory database claim is more operationally interesting. A table set naming hospital customers, purchase orders, and implant lot shipments maps supply relationships across surgical service lines.
Read a listing as a claim
Neither organization has confirmed an intrusion. A leak-site post is not proof of exfiltration; crews recycle old data and occasionally name organizations they never touched. What separates this one is specificity. Victim counts, backup dates, and scan-modality detail are texture fabricated posts rarely carry.
For ophthalmology and orthopedic practices, verify whether December 2025 backups still exist in accessible storage, confirm retention limits are enforced, and segment imaging archives behind separate credentials from practice-management systems. For implant manufacturers, audit who holds quality system records.
