A ransomware crew that keeps circling U.S. healthcare has posted a Charlotte allergy and immunology practice to its dark web leak page.
The group known as Chaos listed carolinaasthma.com, the site for Carolina Asthma and Allergy Center, on September 29, 2026. In its post, the crew claims it took roughly 290 GB of patient and administrative files.
The alleged haul includes patient names, dates of birth, medical record numbers, Social Security numbers, phone numbers, and home addresses, alongside business records such as procurement and financial documentation. The practice has not confirmed a breach or the data types involved.
Leak-site claims are unverified until the victim or credible reporting corroborates them, but Chaos has spent the year inside the sector. The same group has listed mankatoclinic.com, a Minnesota clinic, and healthcarehighways.com, a benefits administrator, on its page in recent months.
Clinics named in these campaigns should treat a listing as a live incident. That means checking whether the exposed volume points to an unpatched perimeter device or a stolen credential, confirming whether records left the building, and preparing patients for the possibility of notifications even before an internal review finishes.
