Skip to content
Leak-site post naming carolinaasthma.com, captured by ThreatCluster

carolinaasthma.com

chaos

Ransomware leak-site victim intelligence

Data size
290 Gb
Views
20,971
Posted
Sep 29, 2026
Country
US
Industry
Healthcare

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, ransom note

The leak post from the chaos group claims 290 GB of data were taken from carolinaasthma.com, with a 24-hour countdown to disclosure. They claim the data includes categories such as Other Patient Forms, Administrative and financial matters, procurement, business services, HIPAA risk assessments, vendor files, insurance records, and government documents. The leak page’s victim profile lists the domain carolinaasthma.com. The page shows publication status as countdown, with 377 views on the leak page.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Carolina Asthma & Allergy Center is the largest asthma and allergy practice in the Charlotte area, staffed entirely by board-certified physicians. They offer a comprehensive range of services including allergy testing, asthma management, and specialized treatments for various allergic conditions. Th…

Data categories
Other Patient FormsAdministrative and financial mattersprocurementbusiness servicesCAAC leased vehiclesHIPAA risk assessmentshospitalsinformation systemsmedical malpractice insurancemiscellaneousproperty and liability insurancevendor filesInsurance claim verificationdebt collection reportsORIGINAL documents related to government agenciespatient billspharmacy benefits coordinatorexecutive meeting minutesCAAC accreditationclinical mattersclinical operationsfinance401(k) retirement planbackground checksACAbenefitsCatapultEmployers’ AssociationEEO-1 employee data formsemployee personnel files

Ransom note

Published by the group on their leak site, reproduced verbatim.

Company management has 24 hours to reach an agreement with us. Otherwise, 290 GB of data will be disclosed, such as “Other Patient Forms” (name, date of birth, MRN, Social Security number, phone number, address… and so on)
Administrative and financial matters, procurement, business services, CAAC leased vehicles, HIPAA risk assessments, hospitals, information systems, medical malpractice insurance, miscellaneous, property and liability insurance, vendor files
Business (insurance claim verification, debt collection reports, ORIGINAL documents related to government agencies, patient bills, pharmacy benefits coordinator, executive meeting minutes… and more)
CAAC accreditation, clinical matters, clinical operations, finance,
Human Resources (401(k) retirement plan, background checks, ACA, benefits, Catapult, Employers’ Association, EEO-1 employee data forms, employee personnel files)

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

This page is currently private; only you have access to it
private

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture