The Booba Project Breach: What It Means for Medical Practices Like Yours

On October 22, 2026, BASS Medical Group, a multispecialty physician group based in Walnut Creek, California, began mailing letters to patients whose billing and health information may have been exposed in a breach the practice first noticed seven weeks earlier. BASS is not a hospital system. It is a group of doctors, a practice-management team, and a billing office, the same shape as thousands of medium-sized medical groups across the country, including, quite possibly, yours.

A new ransomware and extortion group that researchers track as "Booba Project" has listed BASS on its leak site, claiming roughly 100 gigabytes of stolen data. BASS has not confirmed who was behind the intrusion or that ransomware was involved; the attribution comes from outside tracking firms, not from the practice's own notice. What is confirmed, in BASS's own filing with the California Attorney General, is the timeline, and the timeline is the part worth sitting with.

A crew that is just getting started

Booba Project posted its first victims in late June 2026. By November 2, Provendata's incident-response tracking counted 54 claimed victims, 23 of them posted in the preceding 30 days. Two days later, on November 4, Breachsense's running count had climbed to 57. Healthcare is the group's single most-claimed sector, at roughly 28 percent of its targets, according to that same Provendata profile.

BASS is not the only medical organization named. The same group has also claimed Pearland Pediatrics, a pediatric practice near Houston, and MorseLife Health System, a Florida senior-care provider, listing 35 gigabytes and 344 gigabytes of data respectively. A crew that started a little over four months ago and is already this active has not finished choosing targets. It is still working through a list.

Why a multispecialty group, not a hospital, is the example to study

Think about what BASS actually runs day to day: scheduling, intake, electronic health records, and a billing office that submits claims to dozens of insurers. That is the operational core of most medium-sized practices, cardiology groups, dermatology groups, orthopedic groups, independent OB-GYN practices, with twenty to a few hundred staff and nowhere near the security budget of a hospital system.

According to BASS's own notice, the information involved includes medical treatment codes, billing information, and health insurance information, exactly the data that sits in a practice-management system rather than a clinical record. Outside trackers list broader categories, including Social Security numbers and dates of birth, but that is unconfirmed by BASS itself; treat it as a possibility worth planning for, not a settled fact.

Double extortion is the part that makes paying pointless

A ransom used to buy one thing: a decryption key. Groups like Booba Project operate on double extortion: they steal the data first, then encrypt what is left behind, and threaten to publish the stolen copy regardless of whether you pay for the key. Paying might get your systems back. It does not get the data back out of the attacker's hands, and it does not stop them from leaking it later anyway. The notice letter BASS is required to send, and the one you would be required to send under the same circumstances, exists because of the leak risk, not the lockout.

The dates that matter

September 4, 2026. BASS detects suspicious activity on its network and begins an investigation.

September 22, 2026. The investigation determines that patient information may have been accessed or acquired.

October 22, 2026. BASS files notice with the California Attorney General and begins mailing patient letters, a month after confirming the scope of the breach.

October 27, 2026. A leak-site post referencing BASS is first observed by ransomware trackers.

Roughly seven weeks passed between detection and patient notification. That gap is not unusual: forensic investigation, legal review, and coordinating a mailing all take real time. But it is also why a plan written in advance, rather than assembled during the incident, is what keeps that window from stretching further.

What a breach like this costs after the fact

If the ransom and the IT cleanup were the whole bill, that would be bad enough. They are rarely the whole bill. In July, the HHS Office for Civil Rights announced that OSF HealthCare would pay $552,250 and take on a two-year, OCR-monitored corrective action plan over a 2021 ransomware attack that exposed 53,907 patients. OCR's findings were not about the ransomware itself. They were about what OSF had not done beforehand: no accurate, thorough risk analysis, and a notification to patients that came months after the attack was discovered.

That settlement was the largest HIPAA penalty issued so far in 2026, one of eight HIPAA settlements OCR has reached so far this year, according to HIPAA Journal's tracking. The pattern across these cases is consistent: regulators are not fining practices for getting attacked. They are fining practices for not being able to show they had looked for the gap beforehand.

What to send your team this week

You do not need to be a Booba Project target to act on this. Send these four questions to whoever manages your practice-management system, your IT provider, and your compliance lead, and ask for answers you can keep on file:

1. When was our last HIPAA risk analysis, and can I see it? Not a policy document. An actual analysis of where patient data lives and what could go wrong with it. If the answer is "a while ago" or "I'm not sure," that is the finding.

2. Who outside our practice can reach our billing and scheduling systems, and why? Vendors, billing services, and integration partners are exactly how a breach at one organization becomes a breach at several.

3. If we lost access to our systems tomorrow, how would we notify patients, and how fast? BASS took roughly seven weeks between detection and notification. Know in advance who drafts the letter, who approves it, and who mails it.

4. Do we have backups that are isolated from our main network, and have we tested restoring from them? A backup an attacker can also encrypt is not a backup. A backup nobody has tested restoring from is a guess.

Ask for answers in writing, and file them. If nobody can answer all four without checking, that is worth knowing now rather than during an incident.

The wider point

Booba Project will almost certainly add victims after this post is published, that is close to guaranteed given its pace since June. The specific name of the crew matters less than the shape of what it targets: medical groups that handle patient data and billing through the same kind of systems every medium-sized practice runs, with less security staff than a hospital and just as much to lose.

A breach like this is exactly what HIPAA security risk analysis work is meant to catch before it happens. If your practice's defenses lean on passwords alone, see why MFA is not a finish line for what attackers try next. For how this looks in practice, read our HIPAA security readiness case study.

If you cannot say with confidence when your last risk analysis happened, who has access to your billing systems, or how fast your practice could notify patients after a breach, that is exactly the kind of gap a Secure Start assessment maps out in a week, before a notice like BASS's has your practice's name on it instead.