CareClinics Data Breach

Seven months prior to the qilin ransomware group listing CareClinics on its leak site, infostealer malware had already captured employee credentials associated with the Malaysian healthcare provider’s systems. This considerable time gap indicates that the threat actors may have possessed the necessary access and tools to target CareClinics long before the 2026-08-30 claimed listing date. The group asserted unauthorized access to CareClinics’s systems and data located at careclinics[.]com[.]my, though no independent verification of these claims has been completed. Over the preceding 60 days, qilin has claimed 248 victims. While the group’s primary geographic focus has historically been the US and Germany, its operations have recently expanded into Southeast Asia. The healthcare sector is identified as a priority target for the group, making CareClinics, a Malaysian healthcare organization, a direct fit within their established targeting patterns.

SOCRadar CTI’s stealer-log analysis revealed a severe exposure in the sample pertaining to CareClinics. The telemetry data flagged a total of three employee credentials linked to Microsoft 365 and internal domain systems, along with four corporate credentials for the third-party service Box. These captured timestamps range from 2025-12-20 to 2026-07-01. This range signifies that the earliest credential capture occurred over seven months before the reported listing date, indicating a prolonged period during which compromised credentials were potentially available before the attack. The existence of these compromised credentials, particularly those associated with Microsoft 365 and Box, could provide threat actors with initial access or facilitate lateral movement within CareClinics’s network. While this telemetry does not confirm that these specific credentials were used in the attack or that a full breach occurred, it highlights a significant risk factor and a potential avenue for compromise that threat actors frequently exploit. The data suggests a notable window of opportunity for credential harvesting before the ransomware group’s public claim.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.