City of Edgewater Data Breach

Booba Project listed the City of Edgewater, a municipal government in the United States, on its dark web leak portal on November 3, 2026, in a listing identified by SOCRadar’s Dark Web Monitoring service. The city administers utility management, permitting, public safety coordination, and municipal administrative functions, all of which carry personally identifiable information belonging to residents and employees. Municipal governments are attractive targets because their IT infrastructure spans many interconnected systems and their data custodianship obligations are extensive, a profile that matches both the services the city operates and the volume of resident and employee records it holds. Booba Project’s current cluster spans four countries: DROUIN SAS (France, Manufacturing), Vetstoria (Sweden, Healthcare), Boardman Park (United Kingdom, Services), and now the City of Edgewater. The victims share no common sector and no geographic logic, reflecting an opportunistic targeting posture in which access is sourced from criminal brokers and deployed wherever credentials validate. The City of Edgewater is the first confirmed US public-sector listing in this campaign window and differs from the group’s earlier victims in both sector and geography, a fit consistent with targeting driven by available access rather than a defined industry or regional focus.

SOCRadar’s stealer-log query returned no records for the City of Edgewater’s municipal domain. This is an inconclusive result, not evidence that the organization is unaffected. Municipal organizations commonly operate under multiple subdomains and citizen-facing service platforms, none of which a single-domain query covers, so credentials belonging to city employees or tied to resident-facing services may exist under alternate domains or in stealer-log feeds outside the queried dataset. Because the leak-site listing is confirmed, the null signal does not change the risk picture; the absence of records in this dataset cannot be read as assurance that no employee credentials have been harvested or exposed. The result should be weighed against Booba Project’s access model. The group operates opportunistically: access is sourced from criminal brokers and deployed where credentials validate. In that workflow, credentials harvested by infostealers and validated by brokers can become the entry point for corporate account access and, ultimately, ransomware deployment, even when a victim’s sector or region shows no pattern. A municipal environment whose infrastructure spans many interconnected systems enlarges the footprint that such validated credentials could reach once inside. This describes a plausible intrusion path consistent with the group’s behavior — it is not a confirmed account of how the City of Edgewater’s network was accessed. Defensive follow-up should treat the stealer-log gap as a monitoring task rather than a clean bill of health. Review authentication logs across all employee-facing systems for anomalous activity in the period leading up to November 3, 2026, and run targeted credential queries across related municipal infrastructure domains to cover the subdomains and service platforms the initial single-domain query missed. Continued dark web and stealer-log monitoring of the city’s domains will help establish whether exposed credentials surface later and whether they connect to the intrusion path behind the listing.