ProCare Data Breach

moneymessage listed ProCare, a US healthcare organization operating via procare[.]com, as a claimed victim on August 30, 2026. SOCRadar CTI identified a single employee credential originating from a device-based infostealer infection on an Android device, with the activity timestamped September 2025. The mobile origin of this credential is noteworthy because it bypasses endpoint detection controls typically deployed on managed corporate workstations, and the access it represents may not appear in traditional device or endpoint logs. This situation is particularly concerning for a healthcare organization, as such access could potentially extend to environments containing sensitive patient data. Over the past 60 days, moneymessage has claimed three victims, with a clear focus on the United States and the Healthcare and Transportation sectors. ProCare, a healthcare entity located in the United States, aligns perfectly with the group’s established targeting patterns. moneymessage operates as a focused, albeit low-volume, threat actor. The selection of ProCare is consistent with this pattern of deliberate targeting within the healthcare industry.

SOCRadar CTI’s analysis returned a “severe_exposure_in_sample” result for the domain procare[.]com. The single flagged credential identified originated from an Android device-level infostealer infection, with the activity timestamped September 23, 2025. It is crucial to note that a single credential harvested from a mobile device may underrepresent the actual exposure if that device was used to access additional systems not captured in the current sample. Furthermore, the Android infection vector suggests that an employee accessed ProCare internal systems from a mobile device, which warrants a review of mobile device management enrollment and access policies. The origin of the credential from a mobile device is significant because it bypasses endpoint detection controls typically deployed on managed corporate workstations. This type of access may not appear in traditional device or endpoint logs, potentially leaving organizations unaware of unauthorized access. For a healthcare organization like ProCare, it is imperative to determine whether this credential provided access to any environments containing patient data. Rotating the identified credential immediately is a critical first step. Following this, it is recommended to audit authentication logs for procare[.]com, specifically looking for mobile user-agent logins or unusual geographic access patterns since September 2025. If possible, identify the specific device through MDM telemetry and assess whether any other systems were accessed via the same device.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.