Soni Medical Centre Data Breach

Soni Medical Centre’s patient portal, secure.lakewoodmedical[.]ca, was targeted by the Booba Project ransomware group, which listed the Canadian healthcare provider on October 2, 2026. SOCRadar CTI found 25 consumer account credentials within stealer logs, spanning a nine-month period from January to September 2026. This extensive exposure window is noteworthy within recent healthcare data breach incidents. The compromised credentials primarily belonged to patients, indicating a significant Account Takeover (ATO) scenario affecting consumer accounts rather than internal employee data. The persistent nature of the compromised accounts, with recurring patient identities appearing across multiple records, suggests prolonged infections on patient devices or repeated credential reuse. The Booba Project group’s activity often involves exploiting compromised credentials to gain initial access. While the SOCRadar findings did not directly reveal employee credentials, the exposure of patient portal access could have served as a reconnaissance vector for threat actors, potentially leading to further intrusion through other means. The healthcare sector remains a prime target for ransomware and extortion groups due to the sensitive and valuable nature of patient data, and the continuous reliance on digital patient portals makes them attractive entry points for attackers.

SOCRadar’s investigation identified 25 consumer-email credential records associated with secure.lakewoodmedical[.]ca, the patient portal for Soni Medical Centre. These records were found within stealer logs and covered the entire nine-month period from January to September 2026. Crucially, all 25 identified records belong to patient or consumer accounts, with no employee credentials surfacing in the analyzed data. This indicates a pure Customer Account Takeover (ATO) profile. The presence of recurring patient identities across multiple records within the dataset suggests either persistent infostealer infections on patient devices or the reuse of credentials over an extended period. It is important to note that the absence of staff credentials in the stealer logs does not rule out the possibility that compromised patient portal access was used for reconnaissance before threat actors escalated their attack through other channels. The identified credential exposure poses a direct risk for regulatory scrutiny under Canadian privacy laws, including PIPEDA federally and PHIPA in Ontario, both of which mandate notifications for serious data breaches. With 25 patient accounts exposed over nine months, Soni Medical Centre has likely crossed the threshold for reporting such an incident to the Office of the Privacy Commissioner and relevant provincial authorities. The clinic should prioritize force-resetting all patient portal credentials, individually notifying affected patients, and formally reporting the incident. Collaboration with their portal vendor, Lakewood Medical, is also recommended to assess access control configurations and implement Multi-Factor Authentication (MFA) for all patient logins. Patients should be advised to monitor for identity theft due to the sensitive nature of the exposed personal health information.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.