Broadstreet HEOR Data Breach

Rhysida listed Broadstreet HEOR on its dark web leak portal on October 28, 2026, a claim identified through SOCRadar’s Dark Web Monitoring service. Broadstreet HEOR is a Canadian consultancy specializing in health economics and outcomes research (HEOR), providing evidence generation and consulting services to life sciences and healthcare organizations. The listing remains alleged, and the company has not confirmed a breach. The company’s profile is notable in this context: as a specialized consultancy handling confidential client health economics data and proprietary methodologies for life sciences organizations, Broadstreet HEOR holds exactly the kind of material that raises extortion leverage without requiring scale. The listing fits squarely within Rhysida’s recent targeting pattern. In the 60 days prior to this listing, the group claimed 26 other victims. Professional Services is the group’s largest target sector by victim count, and its top three geographic concentrations are the United States, Germany, and Canada. Comparable Rhysida listings — Canadian firms or professional and consulting services organizations — include Sanders Law Group, Reed & Giordano PA, Gress Clark Young & Schoepper, and RealManage. Broadstreet HEOR, a Canadian professional services firm, matches the group’s typical sector and geographic targeting.

SOCRadar’s telemetry query against broadstreetheor[.]com returned a single credential record tied to the files.broadstreetheor[.]com subdomain. The associated username is masked, preventing definitive classification as an employee versus an external user. One record is not a meaningful foothold indicator, but it is also not clearance: telemetry queries are paginated samples covering one slice of available feeds, and additional records may exist under alternate domains, under personal email aliases, or in datasets not queried here. Records may also have been used and rotated before indexing, or may not yet have been indexed. The absence of further records therefore does not rule out that a compromise occurred. Rhysida’s targeting pattern is the primary risk driver. The group uses infostealer credentials — sourced from underground markets and validated against Microsoft 365, VPN, or remote-access portals — as its entry vector. While this does not confirm that credential-based access was used against Broadstreet HEOR, the observed telemetry and the group’s known modus operandi suggest that exposed credentials could support an intrusion path leading to ransomware deployment. The appropriate immediate response includes a proactive credential-hygiene check against broadstreetheor[.]com accounts, password rotation where warranted, and MFA enforcement across all access points. Continued monitoring of dark web stealer logs, including alternate corporate domains and remote-access activity, is recommended to identify any further exposure.