Green Clinic Data Breach

On October 14, 2026, the Wallstreet ransomware group claimed to have breached Green Clinic, a healthcare provider operating in the United States under the domain green-clinic[.]com. Prior to this claim, SOCRadar’s stealer-log telemetry had identified credential exposure related to the same domain. This incident highlights the persistent threat to the healthcare sector, which remains a prime target for ransomware and extortion operations due to the sensitive nature of the data it handles and the critical operational impact a disruption can cause. In the 60 days preceding this claim, Wallstreet reportedly targeted 32 other organizations, with a focus on the Healthcare, Professional Services, and other sectors. The United States, Sweden, and the United Kingdom were the most frequently targeted countries by the group. Notable similar victims include Danvikshem / Stiftelsen Danviks Hospital in Sweden and Lambertinum Seniorenwohnanlage in Germany, both in the healthcare industry. This pattern suggests Wallstreet is actively targeting Western healthcare systems, likely selecting victims based on the sensitivity of their data and the potential for significant disruption.

SOCRadar’s analysis of stealer-log data revealed two records associated with green-clinic[.]com. One of these records involved a corporate email account, jth****s@green-clinic[.]com, which was found in logs harvested from lexmark-printer[.]net, a third-party printer management platform. This exposure occurred over a four-month period from November 2025 through March 2026, indicating unrotated credentials were available for an extended duration. The context suggests that infostealers operating on clinic endpoints captured browser-saved credentials submitted to the vendor portal, along with internal authentication artifacts. The significant freshness window of these credentials provided attackers with sustained access without an immediate need to rotate them, increasing the risk of compromise. The exposure of credentials through third-party vendor portals, particularly for services managing essential infrastructure like printers, presents a critical access pathway into healthcare environments. Platforms such as lexmark-printer[.]net often maintain persistent authenticated sessions with administrative privileges for device management. Credentials harvested from these portals can grant attackers visibility into endpoint configurations and potentially wider network access. This situation underscores the importance of continuous monitoring for credential exposure, especially from third-party services. The observed credential exposure through a third-party vendor portal, specifically a printer management platform, presents a significant potential access pathway for threat actors targeting healthcare organizations. This method allows for the harvesting of workstation credentials submitted to the vendor, alongside internal authentication data, potentially granting attackers sustained access to sensitive systems if credentials are not rotated promptly. To mitigate such risks, organizations should implement ongoing dark web and stealer-log monitoring, enforce robust multi-factor authentication across all remote access points, and deploy advanced endpoint detection capabilities to identify and neutralize infostealer activity before compromised credentials can be exploited on underground markets.