A Canadian home care charity and three smaller clinics landed on Booba Project’s dark web leak page inside a single thirteen-minute window on November 10, the latest sign that ransomware crews are batching small healthcare victims rather than hunting one large hospital at a time.
Acclaim Health, a community home care provider based in Burlington, Ontario, heads the run with 51 GB of claimed exfiltration. El Portal Imaging Center in Mexico, Collier Sports Medicine and Orthopedic Center, and Georgetown Sleep Center followed within minutes; the sleep center claim totals 105 GB.
One afternoon of listings
Ransomware.live logged the Acclaim entry at 12:50 UTC, with the remaining three stamps clustered from 12:51 to 12:52. Three of the four are tagged as hospitals and health care, and all four sit in the healthcare activity category.
The clustering is the story. A gang posting four medical victims in one burst is running a repeatable process against organizations that rarely staff a detection team.
Why these providers absorb the hit
Home care agencies, imaging centers and sleep labs hold records that cannot be reissued like a password. A stolen diagnosis list or medical record number follows a patient for life, and an elderly client receiving in-home visits has no way to freeze a clinical file.
None of the four has publicly confirmed an intrusion, and a leak page listing remains a claim. Acclaim Health’s public exposure profile does show a large indexed password set tied to its domain, a familiar foothold for credential-first crews.
What security teams should do now
Treat a listing as a disclosure clock. Verify or deny internally within days, rotate credentials across remote access and email, and check whether your business associates surface on the same page. For home care, the remote access estate is the surface that matters most.
