Skip to content
Leak-site post naming CDA, captured by ThreatCluster

Ransomware leak-site victim intelligence

Posted
Oct 10, 2026
Industry
Not Found

What was taken

Internal domain: CDA.local. Servers encrypted. 100,000+ DICOM files extracted from medical imaging archive. Patient names, IDs, birth dates, study descriptions, and referring physicians are present...

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture