Caduceus Medical Group Data Breach

The anubis ransomware group has claimed responsibility for a data breach targeting Caduceus Medical Group, a healthcare organization based in the United States, on August 30, 2026. SOCRadar’s CTI analysis noted the claim, which included the threat actor’s assertion of unauthorized access to the group’s systems and data. While the claim is noted, current infostealer datasets showed no identified credential records tied to the organization’s domain as of the reporting date, meaning the claim is unverified. The healthcare sector is a frequent target for ransomware groups due to the sensitive nature of the data handled and the critical services provided, making organizations within this industry attractive targets. Over the preceding 60 days, anubis has claimed nine victims. The group primarily targets organizations in the United States and Germany, with a significant focus on the Healthcare and Manufacturing industries. Caduceus Medical Group’s presence in the US healthcare sector aligns precisely with anubis’s established targeting patterns. This suggests a potentially strategic choice by the threat actor, indicating a tendency for low-volume but highly sector-specific attacks.

SOCRadar CTI’s analysis of stealer-log data for Caduceus Medical Group returned a “no_exposure_in_sample” verdict as of August 30, 2026. This indicates that no credential records associated with the domain caduceusmedicalgroup[.]com were found within the analyzed infostealer datasets. However, this null result does not definitively clear the organization of compromise. Plausible initial-access vectors, consistent with anubis’s known tactics, techniques, and procedures (TTPs), could still include phishing campaigns, exploitation of public-facing vulnerabilities, or credential stuffing attacks, even if not immediately apparent in the sampled stealer logs. The absence of identified credential exposure in the analyzed datasets does not rule out a potential compromise or the possibility of data exfiltration. Credentials may exist under alternate corporate domains, use personal email aliases, or have been used and rotated prior to their indexing in the queried feeds. Furthermore, data may not have been indexed yet or could reside in datasets not covered by this specific analysis. Therefore, a continued lack of evidence is not evidence of an absence of a compromise. Given the nature of the claim and the potential for various initial access methods, organizations are advised to maintain vigilance. This includes continued monitoring of the dark web and infostealer logs for any emerging information related to Caduceus Medical Group. Proactive measures such as credential hygiene checks, password rotation, and comprehensive reviews of multi-factor authentication (MFA) status are crucial. Furthermore, monitoring activity on Microsoft 365, VPNs, and other remote-access portals can help detect any unauthorized access attempts.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.