Terrebonne Parish Government Data Breach

Booba Project listed the Terrebonne Parish Consolidated Government on its leak site on October 29, 2026. The parish government administers public works, utilities, and community development for the Houma, Louisiana metropolitan area, operating under the domain tpcg[.]org. As a municipal government entity responsible for citizen-facing services and internal administrative operations, Terrebonne Parish represents the type of local government infrastructure that extortion groups frequently target, particularly where secure web portals and authenticated access to resident data and inter-agency systems are involved. SOCRadar observed the listing on the group’s leak site, and the claim remains alleged pending independent confirmation. The listing fits squarely within Booba Project’s recent operational tempo. Over the past 60 days, the group has listed 32 victims, with activity concentrated in the United States, Canada, and Pakistan. Its most frequently targeted sectors are Government & Defense, Healthcare, and Education. Recent government-sector victims include Washington County and The Merrimack County, giving Booba Project a clear track record of municipal and county government claims. Terrebonne Parish aligns directly with this established municipal government targeting pattern, matching both the group’s preferred sector and its heavy geographic focus on the United States.

SOCRadar’s infostealer-log telemetry identified 25 records tied to the domain tpcg[.]org, active between August and October 2026. Notably, these records include credentials harvested from secure.tpcg[.]org — the parish’s secure web portal infrastructure. With logs running through October 2026, credential availability in underground markets likely preceded the leak-site listing by weeks, creating a sustained window in which authenticated access to resident data, inter-agency communications, and administrative systems may have been possible. The presence of portal-specific credentials rather than a single harvested record from a personal account is what distinguishes this dataset. The combination of a government secure portal and 25 records is significant from an intrusion-path perspective. Infostealer-harvested credentials tied to portal infrastructure represent sustained access potential to the systems that handle citizen-facing services and internal government operations. The record volume and recency suggest that Terrebonne Parish was specifically queried in underground markets rather than discovered by chance, indicating possible active interest in this organization’s credentials. This could include validation of the harvested credentials for resale or use by initial access actors seeking entry into government network environments. However, the telemetry alone does not confirm that these credentials were actually used to breach the parish’s systems, and no direct correlation to a confirmed intrusion has been established. Defenders monitoring this incident should continue tracking dark web and stealer-log activity tied to tpcg[.]org, including potential exposure under alternate corporate domains. Proactive credential-hygiene checks, password rotation for portal and administrative accounts, and a review of multi-factor authentication coverage on secure.tpcg[.]org and related remote-access infrastructure are prudent given the sustained August-to-October exposure window and the group’s demonstrated interest in municipal government targets.