IN the first half of 2026, a new threat actor group named "Orova" has targeted U.S. medical entities, listing three victims on their dark web leak site: Wisdom Oral Surgery in New Jersey, Cardiology Associates of Port Huron in Michigan, and Magnolia Dental in Florida. The incident has raised concerns due to the sensitive patient data involved, especially in the case of Cardiology Associates, which surfaced claims of over 144 GB of data theft, including Social Security numbers and personal health information.
Despite attempts by DataBreaches to contact the affected practices, responses were minimal, raising questions about compliance with patient notification regulations. Orova described itself as a Ransomware as a Service (RaaS) entity and has indicated that it will proceed with data leaks despite claims of deleting some files after unsuccessful extortion attempts.