Collier Sports Medicine Data Breach

Booba Project listed Collier Sports Medicine on its dark web victim site on 2026-11-10. The US sports medicine clinic operates in the specialty outpatient healthcare sector, which has become a recurring focus of this ransomware operation’s recent activity. SOCRadar observed the listing through dark web monitoring of the group’s victim publication site. The clinic’s operational profile helps explain why it may attract extortion activity: sports medicine clinics running patient portals, imaging referral networks, and insurance billing integrations represent exactly the target profile the Booba Project campaign favors, and the group’s listings have shown a consistent focus on small-to-mid-sized US healthcare practices. The listing forms part of a broader campaign that has claimed approximately 20 victims in the past 60 days. Recent listings include Horizon Eye Specialists & LASIK Center, BASS Medical Group, KING FAMILY MEDICAL, and MorseLife Health System, and the pattern indicates that Booba Project is systematically working through the US specialty and community healthcare sector. Collier Sports Medicine fits squarely within this targeting pattern, joining a string of specialty outpatient healthcare listings rather than standing out as an outlier in the group’s recent activity.

SOCRadar’s stealer-log query for Collier Sports Medicine returned no matching credential records. That result is bounded by the datasets sampled, and a null result should not be read as an all-clear. Credentials may exist in feeds outside the sampled datasets, and records may simply not yet have been indexed, so the absence of matching entries does not confirm that the organization is unaffected. Given the leak-site listing, Collier Sports Medicine should treat this as a potential breach and review access logs for anomalous authentication activity rather than relying on the null telemetry result alone. Booba Project uses infostealer-sourced credentials as a primary access vector, with logs from stealer families such as Lumma, RedLine, and Stealc circulating through dark web markets and Telegram. Credentials harvested in this manner may be validated and subsequently used to gain access to corporate accounts and remote-access entry points, potentially supporting ransomware deployment. While the telemetry result does not confirm that this exact access method was used against Collier Sports Medicine, the group’s credential-driven intrusion model means that any exposed credentials tied to the clinic’s environment could represent a plausible path in. Healthcare practices with limited security operations should prioritize phishing-resistant MFA on all remote access and patient portal systems and maintain continuous credential exposure monitoring. Continued dark web and stealer-log monitoring can surface credentials tied to the clinic’s domains if they appear in future datasets, and SOCRadar’s Attack Surface Management and Dark Web Monitoring modules provide that coverage alongside the recommended review of authentication activity.