BASS Medical Group Data Breach

BASS Medical Group, a US-based healthcare provider delivering gastroenterology, surgical, and specialist services through bassmedicalgroup[.]com, was listed on Booba Project’s dark-web leak portal on October 27, 2026. The listing was identified via SOCRadar Dark Web Monitoring and forms part of Booba Project’s extensive October 27 batch, reflecting the group’s sustained targeting of US healthcare providers. As a medical group handling sensitive patient and clinical data, BASS Medical Group fits squarely within the sectors that ransomware and extortion operations find both lucrative and pressure-prone, where disruption of services and exposure of health-related information increase the likelihood of payment. The listing is consistent with Booba Project’s broader campaign. Over the previous 60 days, the group claimed 25 victims, with its primary targeted sectors being Healthcare, Education, and Government & Defense, and its primary geographies being the United States, Canada, and Pakistan. Other Booba Project US healthcare listings from this period include MorseLife Health System, EdgeEndo USA, Raleigh Family Medicine, and Associated Gastroenterologists of Central New York. BASS Medical Group matches the group’s typical targeting pattern closely, both geographically and sectorally, and the concentration of gastroenterology and surgical practices in the victim list warrants attention from similar organizations.

SOCRadar queried bassmedicalgroup[.]com against its stealer-log telemetry and returned 22 records, all classified INTERNAL_AUTH_EMPLOYEE (category A). The records consist exclusively of @bassmedicalgroup[.]com corporate usernames and span three distinct endpoint types: Microsoft identity infrastructure (login.microsoftonline[.]com), healthcare-specific SaaS platforms, and third-party benefits and healthcare network portals. Log and insert dates range from August through October 2026, indicating recent credential harvesting, with fresh records extending through October. The diversity of affected platforms across Microsoft identity, healthcare SaaS, and third-party portals indicates credentials were harvested from multiple endpoints over time rather than from a single compromised machine. This telemetry constitutes a high-confidence pre-compromise profile. Twenty-two category-A records with confirmed corporate usernames appearing on Microsoft identity infrastructure suggest that valid corporate credentials are circulating in infostealer-driven log data. Infostealer-harvested credentials frequently feed ransomware operations: access brokers and ransomware operators can validate exposed credentials and use them against corporate accounts, Microsoft 365, VPNs, and remote-access portals to establish initial access before deploying ransomware. While the stealer-log records do not prove that this exact access method was used in the Booba Project intrusion, they may have supported it, and the presence of corporate credentials in these datasets does not rule out an active or completed compromise. This should be treated as an incident-response trigger, not a monitoring item. Priority actions are to rotate all bassmedicalgroup[.]com credentials immediately, review Azure Active Directory sign-in logs for anomalous access, and audit all third-party platform access where corporate accounts are used. Continued dark web and stealer-log monitoring, along with proactive credential-hygiene checks and multi-factor authentication review across Microsoft 365, VPN, and remote-access entry points, is warranted given the recent harvesting window and the overlap with the ransomware listing.