baidu3250617231
Attribution profile
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known by the alias baidu3250617231 has been referenced in open‑source reports as operating from China, although no further biographical or organizational details have been publicly disclosed. This alias appears on social media platforms, specifically Twitter, where the actor has communicated directly with journalists and breach‑reporting sites. No additional affiliations, sponsorships, or broader operational scope have been identified in the available material.
In September 2018 the actor claimed responsibility for exposing patient data belonging to Gwinnett Medical Center, posting messages that asserted the information had appeared online and offering free credit‑monitoring services to affected individuals. Supporting the claim, the actor shared images that were described as having been taken from an internal Axis camera system, which were presented as proof of access to the facility’s environment. The actor engaged with Steve Ragan of Salted Hash, providing the pictures and additional details after being contacted by the breach‑reporting website DataBreaches.net. Throughout the exchange the actor maintained that the medical center was either covering up or denying the incident, even as the center itself stated it was investigating the allegations and had not confirmed a breach.
Public sources note that the veracity of the actor’s assertions remains unverified; Gwinnett Medical Center has not confirmed whether the data exposure resulted from a hack, a misconfiguration, or another cause, and no independent technical evidence has been presented to substantiate the claim of unauthorized access. The incident report emphasizes the contradictory nature of the actor’s offered assistance and the lack of clear motive or attribution in the available coverage. No further campaigns, tools, or tactics have been publicly linked to baidu3250617231 beyond this single episode. Consequently, the profile is limited to the confirmed facts of the alias, the stated location, and the specific allegations made regarding the Gwinnett Medical Center case.
Incidents
Attributed incidents are available to members.
1 incident