ClaimTek Systems Data Breach

Rhysida listed ClaimTek Systems on its leak site on October 29, 2026. ClaimTek is a US-based provider of medical billing and practice management software, serving physicians, therapists, and medical billers with an all-in-one clinical documentation, coding, and revenue cycle management platform. The company sits in the healthcare supply chain, which gives the listing significance beyond its own environment: a compromise of ClaimTek’s systems has downstream implications for the healthcare providers and patient data environments that depend on its platform. This exposure, combined with observed credential leakage involving the company’s domain, makes ClaimTek a plausible and attractive target for ransomware and extortion activity. Rhysida has listed 29 victims in the past 60 days, concentrated in the United States, Germany, and Canada. Professional Services, Financial Services, and healthcare technology feature across its recent listings, with named victims including NEAD Pro, Legis, Kreishandwerkerschaft Borken, MPA Pharma, Axdia International, Rug & Home, and Professional Retail Services. ClaimTek represents Rhysida’s continued pursuit of healthcare IT vendors and fits the group’s established geographic and sector pattern, overlapping with its focus on US-based organizations and healthcare-adjacent technology companies.

SOCRadar’s infostealer-log telemetry surfaced three records tied to claimtek[.]com, observed between February and May 2026. The records include credentials from an RDWeb (Remote Desktop Web) gateway, which constitutes a direct pathway into internal networks once authenticated. The material detail is not merely a portal credential but remote access infrastructure. Harvested RDWeb credentials were sitting in underground markets for roughly five months before the October leak-site listing, an availability window long enough for multiple actors to have acquired and used those credentials. This credential exposure represents a concrete initial-access risk rather than a theoretical one. Infostealer-harvested credentials for remote-access infrastructure such as RDWeb gateways can be validated, sold, or brokered in underground marketplaces and may support corporate account access and ransomware deployment. While this telemetry does not confirm that Rhysida’s alleged intrusion against ClaimTek used this specific access path, the presence of remote-access credentials in circulation materially elevates the organization’s intrusion risk and cannot be dismissed as incidental. The assessment reflects the structural exposure involved: medical billing software occupies a sensitive position in the healthcare supply chain, so credential compromise affecting ClaimTek’s remote-access perimeter carries potential consequences for the provider environments the platform serves. Defenders should prioritize proactive credential-hygiene checks and password rotation for any accounts tied to the affected domain, review multi-factor authentication coverage on RDWeb and other remote-access portals, and monitor Microsoft 365, VPN, and remote-access activity for signs of anomalous authentication. Continued dark web and stealer-log monitoring, including checks for credentials appearing under alternate corporate domains or personal email aliases, is warranted given the extended window during which these records have been available underground.