Raleigh Family Medicine Data Breach

Raleigh Family Medicine, a primary care provider located in Raleigh, North Carolina, has been listed on the dark web leak site of the Booba Project ransomware group. The listing, dated October 2, 2026, claims the group has exfiltrated data from the organization. Healthcare practices, particularly those specializing in family medicine, store extensive patient health records, including detailed medical histories, prescription data, and insurance information, all of which are protected under HIPAA. The potential for ransomware deployment in such an environment poses direct risks to patient safety if clinical systems become inaccessible or encrypted. Booba Project has recently focused its efforts on small and mid-sized healthcare facilities over the past 60 days. This strategic targeting is likely due to these organizations possessing substantial HIPAA-protected data while often having fewer robust security resources compared to larger hospital networks. The medical records of family medicine patients, encompassing chronic condition management, medication adherence, and preventive care details, represent valuable information for both extortion and identity fraud. The double extortion tactic employed by such groups can be particularly impactful for organizations where patient trust and regulatory compliance hinge on the confidentiality of sensitive data.

SOCRadar’s stealer-log intelligence identified a Workstation Compromise record associated with Raleigh Family Medicine. This record, dated February 22, 2026, pertains to a staff account (partially masked as kfi****[email protected]) that accessed rxassist[.]org. This website is a platform for pharmacy medication assistance and prescription information. While accessing such a portal is a normal part of clinical workflow, the presence of an infostealer on the device at the time of the session is indicated by this record. It is important to note that a single record does not preclude further compromise and the sensitivity of credential exposure in a clinical pharmacy-adjacent setting remains significant, particularly concerning HIPAA. The capture of a single staff credential through an infostealer on a workstation used for accessing a pharmacy assistance portal raises concerns. This event provides a potential initial access vector for ransomware operations. The incident date of February 22, 2026, suggests a possible dwell time of approximately eight months for the Booba Project ransomware group before the leak-site listing on October 2, 2026. The extent to which protected health information was accessible from this compromised workstation is a critical factor in determining whether HIPAA breach notification requirements have been triggered, necessitating immediate assessment by the practice. Assessment: A single compromised workstation can serve as sufficient initial access for a ransomware group to infiltrate a network. The dated evidence of an infostealer infection on February 22, 2026, provides a substantial window of nearly eight months for the Booba Project to potentially conduct reconnaissance, move laterally, and exfiltrate data before listing Raleigh Family Medicine on October 2, 2026. The practice must urgently determine the scope of protected health information (PHI) accessed from that specific workstation to ascertain its HIPAA breach notification obligations and engage with the Department of Health and Human Services (HHS) and the Office for Civil Rights (OCR) for a preliminary assessment. Next Steps: – Conduct endpoint forensics on the workstation associated with the compromised account (kfi****[email protected]) to identify and eliminate the infostealer infection. – Audit all system access logs from February 22, 2026, onwards to detect any unauthorized activity. – Evaluate HIPAA breach notification requirements and initiate preliminary breach assessment discussions with HHS/OCR. – Deploy Endpoint Detection and Response (EDR) solutions on all clinical workstations. – Enforce strict browser credential hygiene policies to prevent future credential harvesting by infostealers.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.