Texas Medical Screening Data Breach

Texas Medical Screening, a healthcare company operating in the United States, was targeted by the Orova ransomware group, as evidenced by a listing on their dark web portal on August 4, 2026. The company specializes in occupational and diagnostic screening, a sector that often holds sensitive personal data for a large number of individuals beyond its direct client base. SOCRadar’s Dark Web Monitoring service detected this listing, marking it as one of the initial targets surfaced by the Orova group. This incident is part of a larger wave of 23 other victims claimed by Orova within a 60-day period leading up to the August 4 listing. This concentrated timing suggests a coordinated initial outreach rather than a sporadic attack pattern. Orova’s recent activity shows a pattern of targeting industries such as healthcare, manufacturing, and financial services, with a significant number of victims originating from the United States, Hong Kong, and Taiwan. Texas Medical Screening, being a US-based healthcare provider, aligns with the group’s preferred sector and geographic focus. Other organizations listed in this batch include Cardiology Associates, Wisdom Oral Surgery, ADG Healthcare, and Global Friction Products, Inc., indicating a broad range of industries being targeted.

SOCRadar’s analysis against its stealer-log telemetry revealed no records associated with the domain texasmedical[.]com. This result, labeled as “no_exposure_in_sample,” does not confirm that the organization is unaffected by a compromise. The queried data represents a paginated sample of a larger dataset, and exposures linked to legacy domains, regional subsidiaries, or corporate systems using personal email aliases would not be captured. Furthermore, screening providers like Texas Medical Screening often authenticate into various partner portals using third-party domains, which would evade domain-specific lookups. Therefore, the domain remains under active monitoring. The methodology employed by ransomware groups like Orova commonly involves the acquisition of infostealer-harvested credentials. These credentials are then either sold by access brokers or used directly by the threat actors to gain initial access to corporate networks. This access is typically achieved through compromised Microsoft 365 accounts, VPN services, or remote-access portals, ultimately leading to ransomware deployment. The absence of direct telemetry for Texas Medical Screening does not preclude this attack vector. Given the potential for credential exposure to facilitate ransomware operations, continued vigilance is recommended. This includes ongoing monitoring of the dark web and stealer-log feeds for any relevant information pertaining to Texas Medical Screening or its associated domains. Proactive security measures such as credential hygiene checks, regular password rotation, and multi-factor authentication reviews should be implemented. Additionally, monitoring activity across Microsoft 365, VPNs, and other remote-access solutions is crucial to detect any unauthorized access attempts.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.