Eyecare Center of Snohomish Data Breach

Eyecare Center of Snohomish, a healthcare provider based in the United States, was identified as a victim on The Gentlemen ransomware group’s leak site on August 23, 2026. This organization specializes in ophthalmology and eye care services, serving the Snohomish County area. Its inclusion among The Gentlemen’s alleged victims adds a smaller US-based healthcare entity to their portfolio, continuing a trend of targeting community-level healthcare organizations. In the past 60 days, The Gentlemen ransomware group has claimed approximately 227 victims. The United States is their most frequently targeted country, with the Manufacturing, Technology, and Other sectors being the primary industries affected. While healthcare is not their top industry focus, this incident highlights the group’s opportunistic approach to targeting various sectors. Among other US victims documented by SOCRadar, Gould Sherwood Consulting and Meridian Logistics Group represent concurrent American targets, while ESCON Group provides a parallel in the US manufacturing sector. The profile of Eyecare Center of Snohomish aligns with The Gentlemen’s inclination towards targeting small and medium-sized enterprises (SMEs) with potentially lower security postures across diverse industries.

SOCRadar’s analysis of stealer-log telemetry revealed no direct records for eyecarecenterofsnohomish.com within the queried dataset. It is crucial to note that a lack of findings in a paginated sample does not definitively confirm the absence of compromise. The scope of the query might not include alternate corporate domains, personal email aliases used for corporate accounts, or credentials that were compromised and rotated prior to indexing. Infostealer-harvested credentials are a significant entry vector for ransomware operations. Although no stealer-log evidence was directly identified for this domain, The Gentlemen group’s modus operandi typically involves phishing, exploitation of exposed VPN appliances, and the use of previously compromised credentials. Therefore, organizations are strongly advised to audit their authentication logs, implement multi-factor authentication (MFA) on all internet-facing services, and consider the leak-site listing itself as a strong indicator that the threat actor has acquired sufficient intelligence on the target, necessitating a review of their security posture.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.