Wisdom Oral Surgery Data Breach

Orova listed Wisdom Oral Surgery, a US healthcare provider, as a victim on its dark web portal on August 4, 2026, with SOCRadar’s Dark Web Monitoring service flagging the post. This specialist clinical practice, a type of organization that often combines a limited IT footprint with highly sensitive patient records, represents one of the initial Orova listings tracked by SOCRadar. The targeting of healthcare entities is consistent with general ransomware trends, where sensitive data and operational criticality can make organizations prime targets for extortion. The 23 other Orova victims from the preceding 60 days were all part of this August 4 batch, indicating it was the group’s first tracked wave rather than an established cadence. Orova has been observed to target healthcare, manufacturing, and financial services, with many listings remaining unlabeled. Victim concentrations are noted in the United States, Hong Kong, and Taiwan. For Wisdom Oral Surgery, the closest matches within this batch include other US healthcare providers like Cardiology Associates, Texas Medical Screening, ADG Healthcare, and Global Friction Products, Inc. The prevalence of small US clinical practices within this batch is a significant indicator for healthcare CTI teams.

A stealer-log correlation query for wisdom-oralsurgery[.]com returned no results within the sampled data. It is important to note that this query covered only a paginated and limited sample. Therefore, the absence of records does not definitively confirm that the organization is unaffected. Credentials may exist under alternate corporate domains or staff personal email aliases that would not surface in this specific lookup. Furthermore, there is a specific practice-related consideration for small clinics like Wisdom Oral Surgery. These organizations often utilize outsourced platforms for scheduling, imaging, and billing, which are managed on vendor-controlled domains. Such configurations would fall outside the scope of a domain-specific lookup. The result was recorded as no_exposure_in_sample, and the domain remains under monitoring. Infostealer-harvested credentials are a common initial-access vector for ransomware groups like Orova. Threat actors or access brokers may purchase fresh logs, validate corporate credentials, and subsequently gain access to Microsoft 365, VPNs, or remote-access portals before deploying ransomware. The absence of confirmed exposure in this sampled lookup does not rule out this possibility. Credentials might exist in data feeds not included in this query, or they may have been used and rotated before indexing. Continued monitoring and proactive credential-hygiene checks are recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.