Ramos Rheumatology

Ramos Rheumatology was compromised in a ransomware attack attributed to dragonforce in May 2026. The organization, operating in the Healthcare sector in United States, was added to the group's data leak site as part of an extortion campaign.

dragonforce operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Ramos Rheumatology is a leading care center in Avoca, PA, specializing in the diagnosis and treatment of autoimmune diseases such as lupus, rheumatoid arthritis, and fibromyalgia. The practice emphasizes personalized care, ensuring that each patient receives tailored treatment plans in a compassionate environment. Their team, including local specialists, collaborates closely with primary care providers to deliver comprehensive rheumatology services. With a commitment to patient autonomy and immediate appointment availability for emergencies, Ramos Rheumatology prioritizes the well-being of its clients

Intelligence correlations link this incident to 1 vulnerability(ies) including CVE-2025-5777, which may have been leveraged as initial access vectors or for lateral movement.