Vetstoria Data Breach

Booba Project added Vetstoria to its dark web leak portal on November 3, 2026, with SOCRadar’s Dark Web Monitoring service identifying the listing. Vetstoria is a Swedish SaaS provider delivering cloud-based veterinary practice management and online booking to clinics across Europe and North America, positioning it at the intersection of the healthcare and technology sectors. The article characterizes it as the most consequential Booba Project listing in this window: a successful compromise would not stop at Vetstoria’s own corporate data but would extend to appointment records, patient data, and operational information across the platform’s entire client base. This multi-tenant concentration of sensitive veterinary and client data is what makes the alleged listing significant, since a single platform-level intrusion could potentially affect many clinics simultaneously. The claim also fits a broader campaign picture. Booba Project’s current activity spans France, where DROUIN SAS in Manufacturing was listed; the United States, where City of Edgewater in Government appeared; the United Kingdom, with Boardman Park in Services; and now Sweden. The sectoral mix is too diverse for sector-focused targeting, and the assessment is that this reflects broker-sourced access deployed wherever credentials are valid. Vetstoria matches that opportunistic, access-driven pattern while simultaneously marking the group’s clearest move into cloud infrastructure — a platform-level compromise rather than a conventional single-enterprise breach.

SOCRadar’s stealer-log telemetry surfaced a severe credential exposure for vetstoria[.]com. The query returned twenty-five records across four platforms: Google Workspace, Microsoft 365, Slack, and Zoho. The freshness window runs from March 2026 through November 2026 — an eight-month span ending immediately before the ransomware listing — and no credential rotation is evident on any of the four platforms. While this telemetry does not by itself prove that Booba Project used these credentials, the volume, platform breadth, and timing place the exposure directly adjacent to the extortion claim. The breadth of the findings points to systematic harvesting from multiple employee workstations over an extended period rather than a single phishing event. For a group characterized as deploying broker-sourced access wherever credentials are valid, long-lived, unrotated corporate credentials could represent a ready intrusion path. Exposed Google Workspace and Microsoft 365 records may open mailboxes, documents, and identity services; Slack credentials could expose internal communications; and Zoho access may reach customer-facing environments. This chain remains a plausible scenario supported by the telemetry, not a confirmed attack method. Against this backdrop, the recommended response is to rotate credentials immediately across all four platforms, audit Google Workspace and Microsoft 365 sign-in logs for anomalous access, and review Slack workspace-level admin permissions. Vetstoria should also confirm whether any exposed Zoho credentials carry access to customer data environments, since downstream customer notification may be required if they do.