Day One RI Data Breach

Booba Project listed Day One RI on its dark web victim site on 2026-11-10. Day One RI is a Rhode Island, United States nonprofit that provides domestic violence services and support, and SOCRadar identified the listing through dark web monitoring of the group’s leak site. The claim remains unconfirmed as an independently verified breach. Nonprofits of this profile can be attractive extortion targets because they often operate with limited IT security budgets while holding highly sensitive client data; in Day One RI’s case, that includes information about domestic violence survivors, whose exposure would carry significant breach and extortion risk. Booba Project has claimed approximately 20 victims over the past 60 days. The campaign has primarily targeted government, education, and healthcare organizations, but recent listings have also included community-serving organizations such as Programs for Parents Inc. alongside Day One RI, indicating that mission-driven nonprofits are being taken as targets of opportunity. Day One RI therefore sits outside the group’s dominant sectors yet matches its recent pattern of reaching into community-serving nonprofits, an overlap that suggests the listing is consistent with Booba Project’s current targeting rather than an isolated exception.

SOCRadar’s stealer-log query for Day One RI returned no matching credential records. That null result is bounded by the coverage of the available dataset: it reflects only records within the sampled scope, and a negative result does not rule out credential exposure in archives outside that sampled scope. Records tied to the organization may exist in feeds beyond the queried dataset, so the absence of matching entries should not be interpreted as evidence that the organization is unaffected. Given the active leak-site listing, Day One RI should treat the claim as a potential breach and review access logs for anomalous authentication activity. Booba Project uses infostealer-sourced credentials — harvested by stealer families including Lumma, RedLine, and Stealc — that circulate through dark web markets and Telegram as a primary access path. Credentials obtained through these channels may provide access to corporate accounts and remote access systems without requiring an exploited vulnerability. No evidence confirms that this exact access method was used against Day One RI, but the group’s reliance on stealer-derived credentials means employee credential exposure remains a plausible intrusion path, and the null stealer-log result cannot exclude it. Nonprofit organizations with limited security resources should ensure that phishing-resistant MFA is applied across all remote access systems and that credentials are monitored continuously for dark web exposure. SOCRadar’s Attack Surface Management and Dark Web Monitoring modules provide this visibility, supporting ongoing monitoring of stealer-log collections and leak-site activity for any records tied to the organization that may surface in future datasets.