South Weber City Ransomware Claim by Booba Project (Oct 2026)

Claim Summary

The Booba Project ransomware group has allegedly listed South Weber City, a US municipal government entity, on its dark web leak site. According to the threat actor, the attack occurred on October 29, 2026, and purportedly resulted in the theft of 295 GB of data described as “Government Administration” records.

This claim has NOT been independently verified by Yazoul Security or, to our knowledge, by any third party. It originates solely from the group’s own leak site posting, which is an inherently self-interested source. The listing provides no proof-of-data samples, no file trees, and no corroborating evidence in the material reviewed. Readers should treat every element of this claim - the attack date, the data volume, and the nature of the exfiltrated files - as unconfirmed assertions by the threat actor.

Threat Actor Profile

Booba Project is a relatively obscure ransomware operation. Public threat intelligence on this group is sparse: there is no established victim count, no documented toolset, and no peer-reviewed research references available at the time of writing. This absence of a track record is itself a significant credibility caveat.

Because the group’s known tools and tactics are undocumented, we cannot attribute specific techniques (for example, initial access vectors, exfiltration utilities, or encryption binaries) to this incident. Analysts should avoid assuming TTPs based on the name alone. Where detection guidance exists for comparable small or rebranded ransomware operations, defenders should apply generic behavioral detections - anomalous data staging, large outbound transfers, and shadow copy deletion - rather than actor-specific YARA rules, none of which are currently available for Booba Project.

Alleged Data Exposure

The group claims to have exfiltrated 295 GB of “Government Administration” data. If accurate, this volume could plausibly include internal correspondence, HR records, procurement documents, and citizen-facing service data. However, the claim is unsubstantiated. Ransomware groups frequently inflate data volumes and mislabel content to maximize pressure on victims.

No data samples, screenshots, or file listings were provided in the reviewed material. Yazoul Security has not accessed, downloaded, or verified any leaked data, and we do not link to leak site content. The true scope, sensitivity, and even existence of the alleged dataset remain unknown.

Potential Impact

If the claim is genuine, a municipal government breach of this scale could expose sensitive administrative records and erode public trust. Potential consequences include regulatory scrutiny, notification obligations, and operational disruption to city services. That said, these are hypothetical risks contingent on verification. Small municipalities are frequently targeted precisely because they hold valuable data with limited security budgets, but a leak site listing alone does not confirm a successful intrusion.

What to Watch For

• Official statements from South Weber City confirming or denying an incident.
• Any notification filed with state or federal authorities.
• Evidence of data appearing elsewhere, which would lend the claim credibility.
• Whether Booba Project publishes proof-of-data samples, a common escalation tactic.
• Reuse of the group name by copycat actors, given its low profile.

Disclaimer

This report is based entirely on an UNVERIFIED claim published by a ransomware group on its leak site. Nothing herein should be treated as fact. Yazoul Security has not independently confirmed the attack, the data volume, or the nature of any exposed information. Ransomware operators routinely exaggerate or fabricate claims to pressure victims. Treat this as a monitoring signal, not a confirmed incident.