Stuckin2019
Stuckin2019, also referred to as “Stuck,” is a threat actor linked in the provided reporting to alleged breaches involving telehealth-related organizations, particularly OpenLoop Health and Zealthy. The content indicates Stuckin2019 is reported by DataBreaches to be a single male individual rather than a group. The actor claimed responsibility for the January 2026 OpenLoop Health intrusion, in which OpenLoop said an unauthorized party accessed certain systems between January 7 and January 8, 2026 and exfiltrated data. Stuckin2019 claimed to have stolen data on 1.6 million patients and shared samples as proof, while OpenLoop publicly confirmed 716,000 affected individuals. Reported sample data associated with the alleged OpenLoop theft included patient names, email addresses, postal addresses, heights, weights, medical information, biometric data, prescription information, and FedEx tracking information. OpenLoop stated the incident did not involve electronic health records, Social Security numbers, or financial account information. The actor also allegedly listed Zealthy data for sale in January 2026, claiming to have obtained 2.1 million patient records including names, contact details, driver’s licenses, patient information, employee data, and other documents; Zealthy had not publicly confirmed those claims at the time of reporting. Across the reporting, Stuckin2019 is described as targeting telehealth companies and using hacking forums to list stolen data for sale, publish proof samples, and claim responsibility. The actor also allegedly communicated with DataBreaches, claiming OpenLoop paid after an initial listing and that the data were deleted except for sample files, and stating he had attacked additional medical entities without identifying them. No nation-state attribution is provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Health Care Equipment & Services
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Claimed responsibility for the OpenLoop Health breach and alleged theft of patient data.
Claimed responsibility for the OpenLoop Health attack and alleged large-scale exfiltration of patient records from the telehealth platform provider.
Claimed responsibility for the OpenLoop Health breach, allegedly exfiltrated patient data, published sample records as proof of theft, and is described as an individual who has reportedly targeted telehealth companies.
A financially motivated threat actor allegedly targeting telehealth providers, stealing and offering patient data for sale, and attempting extortion by contacting victims to seek payment in exchange for not leaking stolen data.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.