EdgeEndo USA Data Breach

On October 2, 2026, EdgeEndo USA, a manufacturer and distributor of endodontic dental products operating via store.edgeendo[.]com, was listed on the Booba Project ransomware group’s leak site. SOCRadar’s threat intelligence identified a prior credential compromise affecting 25 customer accounts on EdgeEndo USA’s e-commerce platform between July and September 2026. This exposure of dental practice purchasing accounts predates the ransomware listing, suggesting a potential pathway for the threat actor. EdgeEndo USA serves dental practices and clinics directly, making its e-commerce platform a critical touchpoint for the healthcare supply chain. The compromise of purchasing accounts is particularly concerning given the potential for access to sensitive procurement data. The Booba Project ransomware group’s targeting patterns are not detailed in this specific report. However, the incident involving EdgeEndo USA highlights a broader trend of ransomware actors exploiting vulnerabilities within supply chain components. The exposure of customer credentials on an e-commerce platform can indirectly impact numerous downstream entities. In this case, 25 dental practice accounts were compromised, indicating a significant number of affected healthcare providers who rely on EdgeEndo USA for their supplies. The nature of these compromises, stemming from infostealer malware on the practices’ own devices, underscores the interconnected risks in the digital ecosystem.

SOCRadar’s CTI intelligence identified 25 customer credential records from stealer-log datasets for the domain store.edgeendo[.]com. These records were captured between July and September 2026, preceding the Booba Project’s leak site listing on October 2, 2026. The compromised accounts belong to dental practices and clinics that utilize EdgeEndo USA’s e-commerce platform for purchases. Four specific dental practice domains were identified within the dataset: @makdental.net, @elevate-wa.com, @bocaratonmoderndentistry.com, and @dunndds.com. The analysis indicates that these credentials were compromised via infostealer malware operating on the respective dental practices’ own staff devices, rather than through a direct breach of EdgeEndo’s infrastructure. The exposure of these 25 purchasing accounts on store.edgeendo[.]com signifies a potential account takeover (ATO) event for the affected dental practices. The presence of these compromised credentials in stealer-log feeds strongly suggests that the information was harvested by malware and is likely available to threat actors. This credential exposure occurred prior to the Booba Project’s claim, implying that the harvested credentials may have been used to facilitate the ransomware group’s operation against EdgeEndo USA or related entities. The e-commerce platform acts as a central repository for procurement credentials, making it an attractive target for actors looking to gain access to multiple organizations within the dental sector. Given the identified credential compromise affecting customer accounts on EdgeEndo USA’s e-commerce platform, immediate response priorities should include the force-resetting of all 25 identified accounts. Furthermore, direct notification to the affected dental practices, with explicit outreach to the four named domains (@makdental.net, @elevate-wa.com, @bocaratonmoderndentistry.com, and @dunndds.com), is crucial. Auditing access logs for store.edgeendo[.]com during the July–September 2026 period for any unauthorized purchases or data access is recommended. Implementing mandatory multi-factor authentication (MFA) on the customer portal is a critical defense measure. The affected dental offices should also review their own internal security practices and flag any suspicious activity during the identified compromise window.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.