Infina Health Data Breach

Infina Health, a healthcare organization, was listed as a victim by the Qilin ransomware group on its dark web portal on July 22, 2026. This incident was identified by SOCRadar’s Dark Web Monitoring service. As a company operating within the healthcare sector, Infina Health handles sensitive patient data and provider systems, making it a prime target for ransomware and extortion groups. Its inclusion on Qilin’s leak site is consistent with the group’s ongoing targeting of the healthcare industry. In the 60 days preceding this listing, Qilin claimed a total of 126 victims. The group has predominantly targeted the business services, manufacturing, and healthcare sectors, with a significant concentration of victims located in the United States, Australia, and Spain. Infina Health’s targeting aligns with Qilin’s established pattern, joining other healthcare entities such as Central Florida Cosmetic & Family Dentistry, Nova Medical Products, Clinica Maitenes, and Dillon Family Medicine, which have also been listed by the group.

SOCRadar’s analysis of infostealer-harvested credentials revealed a significant exposure linked to the infinahealth.com domain. The investigation identified approximately ten corporate credentials associated with organizational systems and around fifteen for corporate users on third-party services. These credentials spanned critical identity and SaaS platforms, including Microsoft 365/Azure AD single sign-on, a dedicated identity provider, Adobe, Zoho, Zoom, a financial billing platform, and a healthcare provider portal. The recurrence of certain corporate usernames across multiple services suggests a potential compromise of one or more endpoints with broad access, indicating a high risk of corporate intrusion. The identified credentials show a long-tailed freshness window, extending from early 2025 through mid-July 2026, pointing to a lack of recent credential rotation. For ransomware operations like Qilin, infostealer-harvested credentials are a known pathway for initial access. Threat actors or initial access brokers commonly source and validate these credentials from underground marketplaces, using them to gain entry into systems such as Microsoft 365, VPNs, or remote-access portals before deploying ransomware. While the observed stealer-log data does not confirm that these specific credentials were used by Qilin in an active intrusion, the pattern of corporate accounts on Microsoft identity endpoints and a specialized provider portal is highly consistent with the typical cyberattack kill chain for such incidents. The evidence of extensive and unrotated corporate credential exposure highlights the potential for further compromise. Organizations with similar profiles should prioritize immediate credential resets, enforce multi-factor authentication across all services, and conduct thorough endpoint triage to identify and mitigate any existing unauthorized access. Continued monitoring of dark web marketplaces and stealer-log feeds for corporate credentials remains crucial.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.