Zynex Listed by Booba Project Ransomware Group

On July 24, 2026, medical technology company Zynex appeared on the leak site of the Booba Project ransomware group. The listing states that internal files totaling 1.4 GB were exfiltrated during a ransomware attack on the IT services and consulting provider. The disclosure does not specify the exact number of individuals affected or list the precise data types contained in the files.

Reported Details from the Listing

The Booba Project leak site entry, first observed on July 24, 2026, states that Zynex suffered a ransomware incident in which attackers successfully exfiltrated data before encryption or during the compromise. The published information states that 1.4 GB of internal files were taken. No sample files have been publicly released at the time of this writing, and the listing does not quantify how many customer records, employee records, or patient-related documents may be included. The primary disclosure source makes clear that negotiations have either failed or reached a public shaming stage, which is the standard escalation path for this group.

Why This Matters for You and Your Family

When a healthcare-adjacent company like Zynex loses control of internal files, the exposure often reaches beyond employees. Patients, vendors, business partners, and anyone whose personal or medical information passed through the company can be placed at risk. Even if the exact contents remain undisclosed, the nature of the victim and the volume of data suggest the presence of names, addresses, dates of birth, Social Security numbers, insurance details, or financial records. Once such information reaches a ransomware leak site, it becomes permanently available to identity thieves, fraudsters, and extortionists who monitor these portals daily.

Medical and financial data retain their value for years. A breach today can fuel account takeovers, tax fraud, or insurance scams months or years later when victims have moved on.

Doxxing and Identity-Chain Risks

Ransomware groups rarely limit themselves to one dataset. A single exposed email or phone number from this incident can be cross-referenced with other breaches to build a complete identity profile. Threat actors chain credentials across services, link gaming handles to real-world identities, and sell or weaponize the resulting dossiers. Children’s accounts are especially vulnerable because parents often reuse passwords or security questions that appear in corporate leaks. What begins as a business compromise can cascade into doxxing campaigns, SIM-swapping attempts, or targeted harassment using information pulled from multiple sources.

Booba Project’s Known Track Record

Public reporting attributes the emergence of Booba Project to late 2024. The group has focused primarily on mid-sized organizations in healthcare, technology services, and manufacturing. Their typical playbook involves initial access through phishing or exploited remote desktop protocols, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. After exfiltration, Booba Project follows a double-extortion model: they demand payment to prevent file publication and further threaten to contact customers or regulators. When victims do not pay, the group posts victim names, file trees, and sometimes partial data samples on their leak site hosted on the clear web. Their activity has been tracked consistently on ransomware aggregation platforms since early 2025.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, then use the cleanup of Warden to break those chains.
• Rotate any password you used at Zynex or related vendor accounts and enable 2FA with an authenticator app everywhere that credential was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover your entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that frequently chain back to the same addresses and emails exposed in incidents like this.
• Let remediation specialists handle data-broker takedown requests and persistent exposure cleanup instead of attempting it manually.

The Zynex listing is a reminder that healthcare-adjacent breaches continue to accelerate and that waiting for confirmation of exactly what was taken is a luxury most families cannot afford. Acting quickly on credential hygiene and identity mapping gives you the best chance of staying ahead of the inevitable follow-on attacks. DoxxScan by GalaxyWarden delivers that continuous monitoring, AI-powered identity-chain mapping, and hands-on specialist remediation for your whole family, including gaming accounts that often become the weakest link in these breach chains.