EdgeEndo® USA Listed by Booba Project Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware crews continue to pressure organizations by posting alleged victims on public leak sites, often before any independent confirmation exists. In that climate, a listing alone can alarm customers, partners, and staff even when the underlying claim remains unverified.

On October 02, 2026, the group known as Booba Project listed EdgeEndo® USA on its leak site and described the matter in brief terms tied to medical-device-related material and a stated volume of data. EdgeEndo® USA has not publicly confirmed the claim as of writing. What follows treats the listing as an accusation, explains what such claims do and do not establish, and outlines conditional steps people can take if they believe they may be affected.

What is being claimed

According to the listing, Booba Project has named EdgeEndo® USA and summarized the claim as “Medical Device Stolen data: 103 GB.” The public record provided for this write-up does not name a method of intrusion, a timeline of alleged access, a count of individuals affected, or a detailed inventory of file types. People affected are reported as unknown. Data types named as exposed are not disclosed beyond that short summary line.

A leak-site entry is a statement by the claiming group. It is not a regulator finding, a company admission, or an entry in a verified breach index. Listings can be exaggerated, recycled, incomplete, or false. Until EdgeEndo® USA or another authoritative source confirms otherwise, the responsible framing is that Booba Project has listed the company and claims roughly 103 GB of material connected in the group’s wording to medical-device data—not that theft or exposure has been established as fact.

The group behind it: Booba Project

Booba Project is known in public reporting as a ransomware and extortion-style actor that follows a familiar pattern: encrypt or exfiltrate data, then threaten publication on a dedicated leak site to coerce payment. Groups in this category typically post victim names, short descriptions, and sometimes sample files or size claims to increase pressure. Their operational details vary by campaign, and not every listing results in a full dump or in independent verification.

For this specific listing, only what appears in the reported summary should be attributed to the group: the naming of EdgeEndo® USA, the medical-device framing, and the 103 GB figure. No additional claims about how the group says it entered systems, what exact folders it allegedly took, or whom it allegedly contacted should be invented. The listing is marketing and leverage from the claimant’s side; it is not a forensic report.

EdgeEndo® USA and its sector

EdgeEndo® USA operates in the dental and endodontic medical-device space, supplying products and related support used by clinicians and practices. Organizations in this sector commonly handle business contact data, order and shipping records, product documentation, quality and regulatory files, and sometimes customer or distributor account information. Depending on how systems are set up, they may also touch professional credentials, support tickets, or limited personal data tied to B2B relationships.

A claimed incident involving a medical-device firm matters because the sector sits at the intersection of healthcare supply chains, regulated product information, and commercial trust. Even an unconfirmed listing can raise questions for clinics, distributors, and partners who rely on continuity of supply and on careful handling of business records. That consequence flows from the nature of the sector and from the public nature of leak-site posts—not from any proven failure at the named company, which has not stated the claim.

What was likely exposed

The facts do not disclose specific data categories beyond the group’s short phrase about medical-device-related “stolen data” and the 103 GB size claim. Exact contents are unconfirmed. It is not established what, if anything, left the organization’s control.

If files were taken from a firm in this sector, organizations of this kind typically hold combinations of corporate documents, customer and distributor contact details, invoices and contracts, product and labeling materials, internal operations files, and sometimes employee or contractor records. They may also store technical or quality-system documentation. None of that inventory should be read as a statement of what Booba Project actually obtained in this case. The listing’s description is the attacker’s framing, not a verified catalog. Any discussion of personal or business risk must stay conditional: if material of those kinds were involved, the usual concerns would apply; if not, the practical impact could be far narrower or nonexistent.

Why it matters

For individuals and small practices that deal with a medical-device supplier, the real-world stakes of a claimed breach—if one were later established—would usually center on business email compromise follow-ons, phishing that references real order or account details, invoice fraud, and misuse of contact data. Professionals might see targeted messages that look legitimate because they echo genuine commercial relationships. Organizations can face reputational strain, customer inquiries, and contractual notification duties when a claim is later validated—or even when it is only widely repeated.

A leak-site listing alone does not prove those harms have occurred. It does establish that a named extortion group has chosen to associate EdgeEndo® USA with a public pressure campaign and a size claim. Readers should separate three layers: what the group asserts, what remains undisclosed, and what would matter if independent confirmation and a real data set later emerged. Conflating those layers turns an accusation into an unwarranted statement of fact about a named business.

What to do now

If you have a relationship with EdgeEndo® USA—as a clinic, distributor, employee, or partner—treat unsolicited messages that cite this listing with caution. Verify payment-change or credential requests through known channels. Prefer official company notices over screenshots from leak sites. Monitor financial and account activity if you share payment or login details with the firm, and consider placing fraud alerts where appropriate for your situation. None of these steps assumes your data was taken; they are prudent if you want to prepare for the possibility.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets unrelated or related to this claim. That kind of check does not confirm or deny the Booba Project listing, but it can show whether your email is already circulating in aggregated breach corpora and help you prioritize password changes and multi-factor authentication on important accounts.

Public detail on this listing remains limited: the reported date is October 02, 2026; the claimed volume is 103 GB; affected people are unknown; and specific data types are not disclosed. EdgeEndo® USA has not publicly confirmed the claim as of writing. Further clarity, if any, will depend on statements from the company, regulators, or other independent sources—not on the extortion site’s marketing language alone.

AICompiled with AI assistance from public sources and published under our editorial standards.