Under the Breach
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2020-04-11
- Last seen
- 2020-04-11
- Updated
- 2026-10-12 13:02
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Under the Breach is a threat actor alias associated with a cybercriminal operating from the United States of America. In April 2020 the actor sold personal data of approximately 1.41 million US doctors that had been stolen from an online healthcare professional directory service, exposing full names, genders, hospital affiliations, practice addresses, phone numbers, and medical license numbers. The incident targeted the healthcare sector within the United States and appeared financially motivated, as the data was offered for sale on a hacker forum. No specific malware families, initial access vectors, tooling styles, state affiliations, or criminal consortium links are publicly documented for this actor. The sale of the doctor dataset represents the only publicly reported operation attributed to Under the Breach.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.