Coastal Carolina Neuropsychiatric Center, PA targeted by Booba Project

• Ransomware group: Booba Project
• Country: United States
• Sector: Healthcare
• Announcement date: October 20, 2026

The threat actor known as Booba Project has published an announcement on their leak site claiming to possess a significant amount of data allegedly belonging to COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA. This announcement, which surfaced on October 20, 2026, suggests a targeted operation against the healthcare provider, though the group's specific motives and methods remain unclear.

The alleged attack by Booba Project

According to the claim made by the Booba Project, the group successfully infiltrated the network of COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA. The threat actor announced the breach on October 20, 2026, asserting that they have obtained a substantial volume of information from the organization's internal systems. This type of activity is characteristic of modern ransomware operations, where attackers often utilize double extortion tactics. In such scenarios, threat actors do not merely encrypt a victim's data to disrupt operations; they also exfiltrate sensitive information to a controlled server, threatening to release it on a public leak site if a ransom is not paid.

Despite the public nature of the announcement, information regarding the Booba Project group remains limited in the public domain. There is a lack of detailed intelligence available to the public concerning the group's origins, technical capabilities, or previous targets. This lack of visibility makes it difficult for security researchers to attribute the attack or predict the group's future movements. The announcement serves as a notification of the alleged theft, marking a critical moment for the targeted institution.

Details of the claimed data theft

The Booba Project claims to have exfiltrated 10 GB of data from the organization. This volume of data suggests a potentially wide-reaching breach of the victim's digital environment. However, the group has not provided any detailed information or screenshots regarding the specific content of the allegedly leaked data. The listing does not specify the types of files or the specific categories of information that were compromised.

The listing names no specific data types.

Impact and risks of the alleged leak

The alleged leak poses a significant risk of exposure for patient and employee data within the healthcare organization. Because the institution is based in the United States, a potential data breach of this nature could lead to legal proceedings and administrative sanctions under HIPAA regulations. The Health Insurance Portability and Accountability Act (HIPAA) mandates strict protections for sensitive patient information, and failures in data security can result in heavy penalties and regulatory scrutiny.

If sensitive medical records are included in the leaked data, secondary risks may emerge for the affected individuals. These risks include identity theft and the potential for targeted phishing attacks, where attackers use stolen personal details to conduct highly convincing fraudulent communications. Such attacks can exploit the trust established between a healthcare provider and its patients, leading to further financial or personal harm.

About Coastal Carolina Neuropsychiatric Center, PA

Coastal Carolina Neuropsychiatric Center is a neuropsychiatry and mental health center located in Jacksonville, North Carolina. The institution provides psychiatric evaluation, treatment, and neurological healthcare services to its patients. Given its role in providing specialized mental health and neurological care, the organization handles highly sensitive information regarding patient health and neurological status.

Implications for the healthcare sector

This incident highlights the ongoing vulnerability of healthcare organizations to cyber threats. For institutions in this sector, the impact of a breach extends beyond operational disruption; it can damage the organization's reputation and erode patient trust. The potential for negative impacts on operational continuity and reputation management is a significant concern for healthcare providers facing such threats.

To mitigate these risks, organizations in the healthcare sector may need to review their data security measures and notify the affected parties. Common defensive steps for organizations include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all access points, and maintaining rigorous monitoring of network traffic to detect unauthorized exfiltration. Furthermore, regular security audits and employee training on phishing awareness are essential components of a comprehensive cybersecurity posture designed to protect sensitive medical and personal information.