Horizon Eye Specialists & LASIK Center Data Breach

Horizon Eye Specialists & LASIK Center, a US-based ophthalmology and vision care provider, was listed on Booba Project’s dark-web leak portal on October 27, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. The organization delivers laser eye surgery and specialist ophthalmology services through its horizonlaservision[.]com platform. The listing is part of Booba Project’s October 27 batch, which included multiple US healthcare and medical practice targets, and underscores the group’s sustained, concentrated campaign against US medical providers across specialties. As a medical practice handling sensitive patient data and operating externally accessible portal systems, Horizon Eye Specialists fits the profile of organizations that ransomware and extortion groups continue to target within the healthcare sector. Booba Project has claimed 25 victims in the past 60 days. Its primary sectors during this period are Healthcare, Education, and Government & Defense, with the United States, Canada, and Pakistan serving as its primary geographies. Other October 27 US healthcare listings include BASS Medical Group, EdgeEndo USA, Raleigh Family Medicine, and Smart Eye Care. Horizon Eye Specialists & LASIK Center therefore matches the group’s current targeting pattern, falling squarely within a batch of concentrated claims against US medical providers spanning multiple specialties.

SOCRadar’s infostealer pipeline returned one record for horizonlaservision[.]com. The record features a masked username and a URL that corresponds to a patient or partner portal login endpoint rather than employee-side identity infrastructure. This makes the classification ambiguous: the credential is potentially a customer-side or patient-portal credential rather than a staff access credential. A single ambiguous record of this kind is insufficient to build a high-confidence intrusion profile, and it does not by itself establish how, or whether, the threat actor gained access to the organization’s systems. The absence of clear employee-side telemetry does not confirm that the organization is unaffected. One ambiguous patient-portal credential does not constitute evidence of an employee-side access pathway, but it also does not rule out compromise: additional credentials may exist under alternate subdomains or staff personal email accounts that were not captured in this dataset, records may exist in feeds outside the queried pipeline, or data may not yet have been indexed. Because patient-portal access can expose sensitive health information, the analysis stresses that a patient portal breach is itself a data breach. The exact role this credential may have played, if any, in the alleged compromise remains unknown, and no direct correlation between the record and Booba Project’s operations can be confirmed at this stage. Given the group’s active campaign against US medical providers, continued dark web and stealer-log monitoring is warranted to identify further credentials tied to horizonlaservision[.]com, including records that may surface under alternate subdomains or personal email addresses. The organization should audit all externally accessible portal systems, perform proactive credential-hygiene checks and password rotation, and enforce multi-factor authentication across patient, partner, and staff authentication flows equally. Reviewing authentication activity on patient and partner portals would help determine whether any exposed credentials have been abused.