Aesthetic Specialty Centre Data Breach

Aesthetic Specialty Centre (ASC), a Pakistan-based healthcare provider operating on the asc-psd[.]com domain, was listed on the dark-web leak portal of the Booba Project ransomware group on October 27, 2026. SOCRadar identified the listing through its Dark Web Monitoring capabilities, flagging the organization’s presence on the group’s extortion site. As a healthcare organization, ASC handles sensitive medical and patient-related data, a sector that consistently attracts ransomware and extortion activity due to the operational criticality of its systems and the sensitivity of the information it holds. The listing itself is presented as a claim by the threat actor and should be treated as alleged rather than an independently confirmed breach. The listing fits squarely within Booba Project’s recent targeting pattern. Over the preceding 60-day window, the group has claimed 25 victims, with healthcare emerging as its most frequently targeted sector. Its primary victim geographies are the United States, Canada, and Pakistan, meaning the current victim aligns with the group’s documented geographic scope. Other recent healthcare listings attributed to the group include Soni Medical Centre (Canada), MorseLife Health System (US), EdgeEndo USA (US), and Smart Eye Care. Aesthetic Specialty Centre’s profile as a Pakistani healthcare provider therefore matches both the sectoral and geographic preferences Booba Project has demonstrated in its recent operations.

SOCRadar queried the asc-psd[.]com domain against its stealer-log telemetry. The query returned 3 records, all classified as INTERNAL_AUTH_EMPLOYEE (category A), indicating corporate-domain usernames (@asc-psd[.]com) tied to the target’s primary domain and authentication endpoints. The log and insert dates for these records fall within November–December 2025, meaning the credentials were harvested approximately one year before the ransomware listing appeared. This long dwell-time between harvest and potential deployment is consistent with the behavior of credential-market pipelines, in which infostealer logs are held, validated, and resold by brokers over multi-month periods before reaching downstream buyers, including initial access brokers who supply ransomware operators. The re-emergence of three category-A records from late 2025 in the context of a 2026 ransomware listing is consistent with how credential marketplaces operate, and the compromise of direct employee credentials on organizational infrastructure represents a confirmed, high-confidence pre-compromise indicator. While telemetry alone does not prove that these specific credentials were used to deploy the Booba Project ransomware, exposed corporate authentication credentials of this type could plausibly support intrusion paths through corporate accounts, VPNs, remote-access portals, and Microsoft 365 environments. The confirmed employee credential exposure should therefore be treated as a live threat signal rather than a historical artifact, and the absence of additional records in the queried dataset does not rule out further exposure under alternate domains, personal email aliases, or feeds outside the dataset queried. Defenders should respond with immediate credential rotation for all asc-psd[.]com accounts, an audit of administrative portal, VPN, and remote-access access logs, and enforcement of multi-factor authentication on all externally accessible systems. Continued dark web and stealer-log monitoring is advised to detect further exposure or resale activity. Healthcare organizations in Pakistan and the broader South Asia region should treat stale stealer-log exposure of this kind as a live threat indicator rather than a closed incident.