El Portal Imaging Center Data Breach

Booba Project listed El Portal Imaging Center on its dark web victim site on 2026-11-10, with SOCRadar identifying the listing through its dark web monitoring. The victim is a Mexican diagnostic imaging center, which makes it a notable outlier in a Booba Project campaign that has primarily targeted US healthcare organizations. Its appearance alongside Aesthetic Specialty Centre, listed in Pakistan, signals that the group’s targeting occasionally extends well beyond US borders. As a diagnostic imaging provider, El Portal Imaging Center operates in the healthcare environment of digital patient records and imaging platforms, handling sensitive patient information and depending on remote access systems — characteristics that help explain why healthcare organizations remain recurring targets for ransomware and extortion operations. Over the previous 60 days, Booba Project has listed approximately 20 victims, with the vast majority concentrated in the US healthcare sector. El Portal Imaging Center’s listing indicates the group maintains opportunistic international reach alongside its US-focused campaign, and it reinforces the point that healthcare organizations in Latin America and other non-US markets should not treat Booba Project as a purely domestic threat. While the Mexico-based imaging center sits outside the group’s dominant US victim profile geographically, it matches the healthcare-sector focus that defines Booba Project’s recent activity, making the sector — rather than the country — the consistent thread in the group’s targeting pattern.

SOCRadar’s stealer-log query for El Portal Imaging Center returned no matching credential records. This null result should be read as a data limitation rather than a clean bill of health. Coverage of organizations operating in Mexico may be limited in the datasets sampled, meaning the absence of records may reflect the scope of the queried telemetry as much as the organization’s actual exposure. The null result does not confirm that credentials are absent, and the organization should treat the leak-site listing as a potential breach, reviewing its access logs and authentication activity accordingly. Booba Project relies on infostealer-sourced credentials as a primary access vector. Credentials harvested by stealer tools such as Lumma, RedLine, and Stealc trade through dark web markets and Telegram, giving the group a steady supply of potentially valid logins. Where such credentials for a target organization remain valid and are not protected by phishing-resistant MFA, they may provide the initial foothold for intrusion and subsequent ransomware activity. No telemetry result ties this exact access method to El Portal Imaging Center, and the absence of matching stealer-log records does not rule out other access paths, but the group’s documented reliance on stolen credentials makes credential exposure a plausible component of its intrusion chain. For defenders, the guidance supported by this analysis is specific to healthcare providers in Mexico and Latin America, particularly those running digital patient records and imaging platforms: ensure phishing-resistant MFA is applied to all remote access systems, monitor for credential exposure via threat intelligence platforms, and maintain continued dark web and stealer-log monitoring. A proactive review of access logs and authentication activity remains the appropriate posture for El Portal Imaging Center given the listing. SOCRadar’s Attack Surface Management and Dark Web Monitoring modules provide the coverage needed to detect future exposure tied to the organization.