Cyber Threat Actor: Under the Breach

Under the Breach is the alias used by a cybercriminal operating from the United States of America. The actor first came to public attention in April 2020 when they offered for sale a large dataset of personal information belonging to US physicians. The alias appears in underground forums where the data was advertised and subsequently sold. No other names or affiliations have been publicly linked to this actor. The location is based on the actor’s presence in US‑based marketplaces and the nature of the stolen data. This establishes a baseline for understanding the actor’s operational context.

The actor’s known activity involves the healthcare sector, specifically targeting an online directory service that stores information about medical professionals. The compromised data included full names, gender, hospital affiliation, practice address, telephone number, and medical license number for approximately 1.41 million doctors across the United States. By offering this dataset for sale on an underground forum, the actor demonstrated a financially oriented activity. The sale of such detailed personal information created heightened risks for healthcare workers during the COVID‑19 pandemic, including potential smishing and phishing campaigns. No evidence has been presented linking the actor to state sponsorship or ideological goals.

The incident reported on 11 April 2020 remains the sole publicly documented operation attributed to Under the Breach. In this operation, the actor exfiltrated the aforementioned dataset from the directory service and listed it on a hacker forum for purchase. The breach did not involve email addresses or medical records, focusing instead on contact and professional identifiers that could be used for social engineering. Security analysts warned that the specificity of the stolen information could facilitate targeted attacks against medical professionals amid a public health crisis. No further campaigns or tooling details have been disclosed in open sources. This summarizes the currently verified facts about the actor’s behavior and impact.