SMCare Data Breach

Panzer ransomware has listed SMCare, a healthcare organization based in the United Kingdom, as a victim on September 28, 2026. This incident marks an expansion of Panzer’s operations into European healthcare services, a sector that, while not its primary target, is not immune to such attacks. SMCare operates under the domain smcare[.]co.uk, serving patients and healthcare stakeholders within the UK market. The healthcare industry, particularly organizations utilizing NHS-shared platforms and third-party care management systems, presents potential avenues for credential exposure that can be exploited by threat actors. In the preceding 60 days, Panzer ransomware has claimed 34 victims, with a significant concentration in technology, manufacturing, and government sectors. Geographically, Germany, France, and Spain have been its most frequent targets. While SMCare’s UK location is not at the center of Panzer’s typical targeting cluster, it falls within the group’s broader Western European operational scope. This incident underscores Panzer’s opportunistic approach, taking advantage of available access points regardless of whether they align perfectly with its usual victimology.

A stealer-log query performed against smcare[.]co.uk returned no records. It is important to note that this null result does not definitively confirm the absence of a compromise. The query’s scope was limited and may not encompass credentials shared via NHS platforms, personal email aliases, or third-party care management systems, which are common in the healthcare sector. Furthermore, credentials could exist in data feeds not covered by this specific query or may have been used and rotated prior to indexing. The absence of evidence in this bounded sample does not constitute evidence that no compromise has occurred. The typical attack vector involves initial access brokers harvesting credentials, validating them against services like Microsoft 365 or VPNs, and then providing access to the Panzer ransomware operators. This forms a pipeline from credential exposure to potential ransomware deployment. Given this methodology, continued monitoring of smcare[.]co.uk and related NHS domains for suspicious activity is recommended. Proactive measures such as forced password rotation should also be implemented to mitigate the risk associated with potential credential exposure.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.