PawlyClinic Data Breach

PawlyClinic, a digital veterinary care platform operating in the United States, was identified as a victim on the Kazu ransomware group’s leak site on August 23, 2026. The company provides digital veterinary consultations and pet healthcare management services. Kazu’s categorization of PawlyClinic under its Healthcare segment highlights the group’s broad interpretation of the healthcare industry, extending to digital health platforms for veterinary care. This targeting indicates a strategic interest in cloud-based healthcare services, rather than solely traditional brick-and-mortar facilities. In the 60 days preceding this listing, Kazu claimed approximately nine victims, with the Healthcare industry being its primary focus, and Mexico, Brazil, and the United States as its leading victim countries. The inclusion of the United States aligns with PawlyClinic’s operational base. Similar to PawlyClinic, PappyJoe is another US-based healthcare target. The ransomware group’s campaign also includes Latin American healthcare entities such as ConsultorioMovil and Centro Médico Especializado OSI in Mexico, and Meducar in Brazil, demonstrating a focus on the healthcare sector across these regions.

SOCRadar’s analysis of initial access vectors, using stealer-log telemetry, found no records associated with the domain www.pawlyclinic.com for the queried data slice. It is important to note that a null result from this specific query does not confirm that the organization is unaffected. The queried sample was paginated, and there is a possibility that credentials exist under alternate corporate domains or were accessed via personal email aliases, which fall outside the scope of this particular investigation. Furthermore, credentials may have been utilized and subsequently rotated before their indexing into the dataset. Credentials harvested by infostealers represent a significant initial access vector for many ransomware operations. While direct evidence from stealer logs was not found for PawlyClinic in this instance, the absence of findings in a limited sample does not guarantee a secure posture. Kazu and similar threat actors commonly gain entry through methods such as phishing, exploiting exposed VPN appliances, or leveraging recycled credentials. Organizations listed by ransomware groups are advised to conduct thorough audits of their authentication logs, ensure Multi-Factor Authentication (MFA) is enforced on all internet-facing services, and treat the listing as a strong indicator that the threat actor possesses substantial intelligence regarding the target. Continuous monitoring of dark web and stealer-log feeds, alongside proactive credential hygiene checks and password rotation, are recommended actions.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.