From: The Seven Deadly Sins <thesevendeadlysins@tuta.io>
To: omar@curemetrix.com, kevin@curemetrix.com, rita@curemetrix.com, danielle@curemetrix.com, tommy@curemetrix.com, diego@curemetrix.com, liz@curemetrix.com
Subject: CureMetrix — Metabase breach · mammography PHI held · 72 hours

CureMetrix,

We have read access to your Metabase instance at https://reports.curemetrix.com
(v0.59.5.1) and the databases attached to it (Mammo DB / MySQL, cmCloud / Redshift,
Snowflake CM Support). We copied a working set of your data and verified your core
HIPAA tables, including patient (576,823 rows), clinical_study (504,630), and
mammo_clinical_data (73,053), plus DICOM headers, S3 imaging index rows, client
mammography reports, and related clinical linkage tables (~1.5 GB exported so far).

We are giving you a chance to handle this privately before anything goes to press.
Nothing is on our public leak board for CureMetrix yet, and we have not contacted
your customers, partners, or journalists. If you appoint one negotiator and reach
us within 72 hours — by 2026-09-24 17:00 UTC — we can discuss proof, scope, and
resolution without a public listing or news cycle. After that deadline we publish
the full archive and treat the incident as public.

HOW TO CONTACT US (preferred: Session)

Session is an encrypted messenger that does not require a phone number or email.

  1. Install Session from https://getsession.org/
     · iPhone/iPad: App Store — search "Session Private Messenger"
     · Android: Google Play — same name
     · Mac or Windows: download the desktop app from getsession.org

  2. Open Session and finish the short onboarding (create your account).

  3. Start a new chat:
     · Tap the compose / "+" icon → "New message"
     · Choose "Enter Session ID" (or "Use Session ID" / "Add contact by ID")

  4. Paste our Session ID exactly (one line, no spaces):

     051b27343be2bafb389aee16bfb6526d1f09d2e487430eb0427336415bb408452d

  5. Send a first message with your name, title, and that you represent CureMetrix.
     We will reply on Session with additional private proof if needed.

Alternative: reply to this email at thesevendeadlysins@tuta.io (Session is faster
and end-to-end encrypted).

PROOF (verify before you reply)

  · curemetrix_proof_7ds.txt — sample rows and live table counts
  · http://37.77.150.177:8080/pay_or_leak/curemetrix/
  · Our contact page: http://sinsp6ibw32abbcoagbjwetgm2w56u7tr4izy3xzp7ehqoenxvdd3qyd.onion/identity/

Please do not broadcast this to MSSPs, counsel lists, or law enforcement before
we have a single point of contact and you have validated the proof — that makes
private containment harder for everyone.

If we do not hear from you by the deadline, we upload
shouldve-paid-the-fucking-ransom-curemetrix-7ds.7z to our archive, list CureMetrix
publicly, and reporters and healthcare customers will learn that an FDA-regulated
imaging AI vendor lost patient registry and S3-indexed mammography data.

The Seven Deadly Sins