Holistic Health Group, Inc. (d/b/a Suncrafted listed by Spacebears

• Ransomware group: Spacebears
• Country: United States
• Sector: Healthcare
• Announcement date: October 15, 2026

The threat actor known as Spacebears has listed Holistic Health Group, Inc. (d/b/a Suncrafted) on its data leak site. The group claims to have compromised the organization's data and is threatening to release it. This announcement was made on October 15, 2026.

The details of the claim

According to the announcement published by the Spacebears group, the organization has been targeted in a cyberattack. The threat actor claims to have successfully exfiltrated data from the victim. This type of activity is characteristic of modern ransomware operations, which often involve a process known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the stolen data on a public platform, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

The threat actor has published the organization's name on their dedicated leak site to signal the breach to the public and the victim. Such listings serve as a method of public shaming and increased pressure on the targeted entity. As of the current reporting, the group has not provided specific details regarding the nature of the alleged stolen data. The provided screenshot associated with the claim does not contain information regarding the content of the data, leaving the exact scope of the breach unknown.

Data involved in the incident

At this time, the listing names no specific data types or categories of information that have been allegedly stolen. No information has been provided regarding the volume of files or the total size of the data exfiltrated by the threat actor. The lack of specific details regarding the content of the data makes it difficult to determine the exact impact of the incident at this stage.

About Holistic Health Group, Inc. (d/b/a Suncrafted)

Suncrafted is a vertically integrated cannabis company based in Massachusetts. The company's operations involve the cultivation, manufacturing, and sale of both medical and adult-use products. Their business model focuses on sunlight-grown products, solventless live rosin, and a commitment to minimal waste.

Risk assessment and industry implications

Given the Spacebears group's focus on data exfiltration and extortion, there may be a risk of sensitive information being exposed. Because the organization is based in the United States, a potential data breach could lead to legal consequences under regulations such as HIPAA, which governs the protection of sensitive patient health information. Such regulatory frameworks impose strict requirements on how healthcare-related entities must protect data and report breaches.

Beyond legal and regulatory risks, there is a significant risk that employees and customers could be subjected to identity theft or targeted phishing attacks if personal information is leaked. Attackers often use stolen data to conduct highly personalized social engineering campaigns, which can further compromise the security of the individuals involved. Furthermore, the double extortion tactic employed by the group may negatively affect the organization's operational continuity and its overall reputation.

The technical capabilities of the Spacebears group remain uncertain, which makes it difficult to fully assess the technical scope and the ultimate impact of the attack. For organizations operating within the healthcare and wellness sectors, maintaining robust cybersecurity defenses is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, strict access controls and continuous monitoring of network traffic can help detect unauthorized data exfiltration attempts before they result in a public leak.