Georgetown Sleep Center Data Breach

Georgetown Sleep Center, a specialty sleep medicine clinic operating in the United States, was listed on the dark web victim site of the Booba Project ransomware group on 2026-11-10. SOCRadar identified the listing through its dark web monitoring of ransomware leak sites. The clinic aligns closely with the profile Booba Project has concentrated on in recent weeks: a small-to-mid-sized outpatient healthcare practice with limited IT security resources, whose patient data holdings make ransomware extortion viable. That combination of valuable health information and constrained security resources is precisely what makes organizations of this type attractive extortion targets. The listing is the latest addition to a campaign that has concentrated heavily on small-to-mid-sized healthcare practices and outpatient providers across the United States, with approximately 20 victims claimed over the past 60 days. Recent additions to Booba Project’s healthcare cluster include Horizon Eye Specialists & LASIK Center, BASS Medical Group, KING FAMILY MEDICAL, and LifeFone. Georgetown Sleep Center fits that pattern closely: a specialty outpatient clinic whose sector, size, and US operating location place it squarely within the group’s current targeting focus rather than representing a departure from it.

SOCRadar’s stealer-log query for Georgetown Sleep Center returned no matching credential records. The query covers a bounded sample of the dark web infostealer datasets available for analysis, and that limitation matters: a null result does not confirm that credentials are absent from archives outside the sampled scope. Matching credential records could still exist in collections that were not part of the query, meaning the clean result should be treated as an absence of evidence within the sample rather than as proof that the organization is unaffected. The null telemetry finding does not rule out an infostealer-based intrusion path. Booba Project relies on infostealer-sourced credentials as a primary access vector, drawing on logs generated by tools such as Lumma, RedLine, and Stealc that circulate through dark web markets and Telegram. Healthcare clinics of Georgetown Sleep Center’s size typically run shared EHR systems, billing portals, and telehealth platforms — surfaces that are standard initial access points for infostealer-based attackers. In such a scenario, harvested credentials could be validated and used to reach remote access systems, supporting later ransomware deployment. This is a possible attack path consistent with the group’s model, not a confirmed method of entry against Georgetown Sleep Center, and the leak-site listing itself should be treated as a potential data breach pending full investigation. Regardless of the telemetry result, credential hygiene reviews and access log audits are warranted. Healthcare clinics with patient-facing portals and third-party billing integrations should ensure phishing-resistant multi-factor authentication is applied to all remote access systems, and they should monitor for credential exposure continuously rather than as a one-time check. SOCRadar’s Attack Surface Management and Dark Web Monitoring modules provide that visibility, and continued dark web and stealer-log monitoring remains the appropriate next step while the listing is under investigation.