KING FAMILY MEDICAL Data Breach

KING FAMILY MEDICAL, a US-based family medical practice, was listed on Booba Project’s dark-web leak portal on October 27, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. The practice operates primary care services through its kingfamilymedical[.]net platform and appears in Booba Project’s October 27 batch, which targeted multiple US healthcare practices alongside educational and government organizations. As a small medical practice handling valuable patient data, KING FAMILY MEDICAL fits the profile that Booba Project appears to deliberately pursue: organizations with limited security resources relative to larger health systems, which are accessible to attackers and hold sensitive patient information. Booba Project has claimed 25 victims in the past 60 days. Its primary targeted sectors during this period are Healthcare, Education, and Government & Defense, with primary geographies concentrated in the United States, Canada, and Pakistan. Other recent Booba Project US healthcare listings include Raleigh Family Medicine, MorseLife Health System, Smart Eye Care, and EdgeEndo USA. KING FAMILY MEDICAL aligns closely with this pattern. The group’s consistent targeting of smaller US medical practices reflects a deliberate strategy toward organizations with limited security resources relative to larger health systems — these victims are accessible and hold valuable patient data.

SOCRadar’s stealer-log telemetry pipeline returned no records for kingfamilymedical[.]net. This null result does not confirm that the organization is unaffected. Stealer-log telemetry is inherently incomplete: credentials registered under alternate domains, practice management system subdomains, or personal email accounts used for business purposes may not appear in the queried dataset. This limitation is especially relevant for small medical practices, which often rely on third-party vendors whose credentials may surface under entirely different domain signatures. Exposed credentials associated with the practice’s staff or vendors may therefore exist outside the visibility of this particular dataset, and the absence of matching records should not be read as evidence that no compromise occurred. The null query result does not resolve the underlying risk. For small healthcare providers, remote-access solutions and cloud-hosted practice management systems are the priority attack surface, and externally accessible entry points remain a concern regardless of stealer-log visibility. The appropriate response is MFA enforcement across all externally accessible systems and proactive credential-hygiene checks — not treating a null query as a clean bill of health. Continued dark web and stealer-log monitoring is also warranted, including attention to alternate corporate domains, practice management system subdomains, and vendor-related signatures, since credential records associated with the practice may surface in these datasets after the current query window.