ADG Healthcare Data Breach

ADG Healthcare, an Egyptian healthcare provider, was listed as a victim by the Orova ransomware group on August 4, 2026. SOCRadar’s Dark Web Monitoring service detected this listing. The organization’s unique position as the sole Egyptian entity and the only healthcare victim outside the United States in this particular batch of claims suggests it might have been targeted due to its sector or geographic location, potentially representing an expansion of Orova’s operational reach. In the 60 days preceding this listing, Orova claimed 23 other victims, all appearing in the same August 4 batch. This indicates a significant coordinated campaign rather than a sustained, ongoing targeting pattern. The victims are predominantly in healthcare, manufacturing, and financial services, although many listings lack specific industry categorization. The primary geographic concentration for Orova’s victims is the United States, followed by Hong Kong and Taiwan. While ADG Healthcare shares sector overlap with other victims like Cardiology Associates and Wisdom Oral Surgery, its geographic isolation makes it a notable outlier and a potential indicator of the ransomware group’s expanding capabilities beyond its usual operational areas.

Correlation against SOCRadar’s stealer-log telemetry revealed significant credential exposure for the domain adg-healthcare[.]com. Three distinct records were identified, all containing employee credentials associated with organizational systems. These credentials shared a common username pattern, matching the organization’s domain prefix, and were captured in relation to organization-owned web assets, including a content management system (CMS) login endpoint. This profile strongly indicates a corporate intrusion risk. The captured credentials show a concerning lack of rotation, with data ranging from December 2025 through June 19, 2026. The same credential repeatedly appeared over a six-month period, with no signs of being updated or changed. This suggests that an administrative account, likely for the CMS login, was exposed and never reviewed or secured. A CMS login on an internet-facing healthcare website is a known recurring pathway for initial access and persistence within the healthcare sector. For ransomware groups like Orova, infostealer-harvested credentials represent a common initial access vector. Threat actors or access brokers often purchase these logs, validate the corporate credentials, and then use them to gain access to systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the current telemetry does not definitively confirm that these specific credentials were used by Orova to breach ADG Healthcare, the pattern aligns with the typical kill chain for such incidents. The presence of a valid, unrotated credential for an organization-owned login, particularly for a critical system like a CMS, presents a clear avenue for intrusion. Consequently, forensic investigations should extend beyond the identity provider to include the CMS layer itself.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.