Coastal Carolina Neuropsychiatric Ransomware Claim by Booba Project (Oct 2026)

Claim Summary

The Booba Project ransomware group has allegedly listed COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA on its dark web leak site. According to the threat actor, the organization was purportedly breached on October 20, 2026, and the group claims to have exfiltrated approximately 10 GB of data described as “Medical Practices” information.

The victim is a US-based healthcare provider operating under the domain coastalcarolinapsych.com. The group’s listing asserts the data theft as complete, but no supporting evidence, samples, or proof-of-compromise artifacts have been independently reviewed by Yazoul Security at the time of writing. This report is based solely on the unverified claim published by the threat actor.

Threat Actor Profile

Booba Project is a ransomware and data extortion group whose operational history remains poorly documented. Public threat intelligence on this actor is sparse: total known victim counts are unknown, and there is no publicly available research detailing their tooling, initial access vectors, or affiliate structure. The group’s known tools and tactics are, at present, unconfirmed.

Because of this limited track record, the credibility of the claim cannot be strongly assessed. Groups with little public history sometimes publish exaggerated or recycled claims to build notoriety, and some operate as low-volume extortion outfits that rely on pressure rather than demonstrated capability. Readers should treat the group’s assertions with heightened skepticism until corroborating evidence emerges.

No YARA rules or detection guidance specific to Booba Project are publicly available at this time. Organizations seeking to monitor for related activity should rely on general ransomware detection practices, such as monitoring for unusual data staging, large outbound transfers, and anomalous encryption behavior, and should consult broader healthcare-sector threat intelligence for context.

Alleged Data Exposure

According to the threat actor, the claimed dataset totals roughly 10 GB and is characterized as “Medical Practices” data. The group has not, per available information, published verifiable samples. The exact nature of the data - whether it includes patient records, billing information, scheduling data, or internal operational files - remains unconfirmed.

Yazoul Security has not accessed, reviewed, or validated any of the purportedly stolen data. No samples, credentials, or download references are included in this report by design. Any assertion about the contents of the alleged dataset should be treated as unverified until the organization itself confirms or denies the claim.

Potential Impact

If the claim is accurate, a healthcare provider handling neuropsychiatric patient information could face significant regulatory and reputational exposure. Healthcare data carries elevated sensitivity, and any confirmed exposure of patient records could trigger breach notification obligations and scrutiny from regulators.

However, these are conditional risks. There is currently no confirmation that data was actually exfiltrated, that the dataset is genuine, or that the organization’s systems were compromised as described. Ransomware groups routinely overstate data volumes and sensitivity to increase pressure on victims during negotiation.

What to Watch For

• Official statements from Coastal Carolina Neuropsychiatric Center regarding the claim.
• Any regulatory filings or breach notifications that would corroborate the alleged incident.
• Publication of verifiable proof-of-compromise by the threat actor, which would raise confidence in the claim.
• Related activity reported by healthcare-sector peers, which may indicate a broader campaign.
• Updates to our intel and advisory pages as more information becomes available.

Disclaimer

This report is based entirely on an unverified claim published by a ransomware group on its leak site. Yazoul Security has NOT independently verified the breach, the data volume, the data contents, or the involvement of the named threat actor. Nothing in this report should be treated as confirmation of a security incident. Ransomware groups frequently exaggerate or fabricate claims to pressure victims. Readers should await official confirmation from the organization or authoritative third parties before drawing conclusions.