Aesthetic Surgical Images Data Breach

Aesthetic Surgical Images, a US-based healthcare organization, has been identified as a victim of the INC Ransom ransomware group. The listing was published on July 7, 2026, and detected by SOCRadar’s Dark Web Monitoring service. The healthcare sector is frequently targeted by ransomware groups due to the sensitive nature of the data it handles. This incident adds Aesthetic Surgical Images to INC Ransom’s portfolio of victims, reinforcing the group’s activity within the United States and the healthcare industry.

While SOCRadar’s initial threat intelligence check found no direct evidence of ‘aestheticsurgicalimages.com’ in stealer logs, this does not rule out the possibility of a compromise. The absence of evidence could be due to various factors, including the use of alternative domains, personal email aliases for credential harvesting, or credentials being rotated before indexing. INC Ransom has been linked to using infostealer-harvested credentials as an initial access vector, often sourced from underground marketplaces to gain entry into networks via Microsoft 365, VPNs, or remote access portals. Organizations are advised to maintain vigilance, conduct ongoing monitoring, and implement robust credential hygiene practices, rather than relying on a lack of immediate evidence as confirmation of safety.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.