# The form fields were the post

2026-09-30

A Chaos post recorded on 29 September names Carolina Asthma and Allergy Center and a 290 GB pile, including patient-form fields. The clinic has not confirmed it. A field list in the ransom text is not a file a reporter held.

Canonical: https://www.fabiocti.com/notes/the-form-fields-were-the-post/
Author: Fabio Correia

DeXpose wrote up a Chaos leak-site post dated 29 September. The post names Carolina Asthma & Allergy Center and gives management 24 hours. If there is no deal, it says 290 GB comes out, and it illustrates that pile with patient-form fields: name, date of birth, a medical-record number, a Social Security number, phone, address, plus administrative and financial material.

That is a paragraph. It is not a sample a newsroom matched to a credit bureau, and it is not a statement from the clinic. I do not have the second of those. Until it exists, the incident you can actually describe is: a group known for this kind of post put this practice’s name on a page and listed the columns a medical form already has.

## Why the column names feel like proof

They are the columns every one of those forms has. Writing them down does not require having opened the archive. It requires having seen a blank. The 24-hour clock is the same move as any other countdown: it manufactures a deadline for people who cannot check the pile. 290 GB is a size, not a row count, and a size in a ransom post is the group’s adjective.

If you are the practice, the work is the boring one. Do you have an object, and is the group’s page the only place your name appears. Pull access logs and the backup that would show a copy leaving. Do not negotiate against a field list. If you are a patient who got a call that already knows a visit, that call is a separate fact from this post, and it is the one to treat as live.

I have written this distinction before, because the post keeps wearing the costume of a record. The costume is the columns. The record would be a page someone else could check.