LifeFone Data Breach

LifeFone, a US-based personal emergency response and medical alert company operating lifefone[.]com, has been listed on the leak site of the ransomware and extortion group Booba Project. The listing appeared on October 29, 2026 and was identified through SOCRadar’s ongoing monitoring of ransomware leak sites. Unlike a typical hospital or clinic target, LifeFone provides continuous monitoring and wearable emergency devices as part of a home-safety ecosystem serving elderly and medically at-risk individuals across the United States. The group’s listing of this healthcare-adjacent victim is notable because the subscriber population is vulnerable, monitoring continuity is critical to subscriber safety, and the company’s data potentially spans caregivers, healthcare providers, and family contacts — a combination that gives an extortion actor obvious leverage. Booba Project has listed 32 victims in the past 60 days, concentrated in the United States, Canada, and Pakistan. Healthcare and healthcare-adjacent organizations are a consistent focus for the group: recent listings include gastroenterology practice ASSOCIATED GASTROENTEROLOGISTS OF CENTRAL NEW YORK, eye care provider Smart Eye Care, and community health services, alongside government and education sector victims. The listing of LifeFone extends this pattern into emergency response services, fitting squarely within the group’s established targeting of healthcare-adjacent organizations and its concentration of US-based victims.

SOCRadar’s stealer-log telemetry query for the domain lifefone[.]com returned no records at the time of publication. This null result applies only to the datasets queried and should be interpreted carefully. Staff who use personal devices and SaaS platforms may hold credentials that exist in infostealer feeds not captured by the queried datasets, and records may not yet have been indexed. The absence of stealer-log hits is no positive signal, not clearance, and it does not confirm that the organization is unaffected. Credentials may also exist under alternate corporate domains or personal email aliases, and they may have been used and rotated before indexing. Infostealer-harvested credentials are commonly sold or brokered on underground marketplaces and can support ransomware operations by providing initial access to corporate accounts, Microsoft 365 environments, VPNs, and remote-access portals, though no such access method has been confirmed in this case. A personal emergency response company sits at the extreme end of operational sensitivity. Disruption does not just affect data — it affects active monitoring for subscribers who may need emergency dispatch. Booba Project’s listing of LifeFone follows the same logic as its healthcare listings: high-consequence data and a high-pressure incentive to pay. The absence of stealer-log hits does not change the risk posture. Organizations in this position should maintain continued dark web and stealer-log monitoring, including monitoring of alternate corporate domains and feeds beyond the queried datasets, and perform proactive credential-hygiene checks, including password rotation and multi-factor authentication review, along with review of Microsoft 365, VPN, and remote-access activity, since harvested credentials remain a plausible intrusion path even when current telemetry shows no correlation.