Actor claims full Sunnybrook hospital…

CriticalBreachNo software to update

In 30 seconds

Alleged

ScarlettGroup is reportedly advertising what it calls the “Full DB” of Toronto’s Sunnybrook Health Sciences Centre. The claim, including the alleged contents and record counts, has not been independently verified, and the cited post says Sunnybrook had not publicly confirmed a breach.

What happened

Alleged

DailyDarkWeb reports that ScarlettGroup escalated an earlier claim by advertising an alleged full database release on a dark web forum. The report attributes the release claim to the actor rather than to Sunnybrook or an independent investigation.

Why it matters

Inferred

If the described data is genuine, the combination of identity, health, insurance and account access information could enable fraud, targeted impersonation and attempts to take over patient portal accounts. Those consequences remain conditional because the underlying dataset has not been authenticated.

What to do

Observed

DailyDarkWeb advises patients to reset portal credentials and treat hospital themed messages cautiously. Given the lack of confirmation, this is precautionary guidance rather than evidence that any particular account or patient record was compromised.

Confirmed and still uncertain

Observed

The cited post documents a public report of ScarlettGroup’s claim and lists the categories and volumes the actor allegedly advertised. It does not independently establish that the files are authentic, that the reported counts are accurate or that Sunnybrook’s systems were breached.

What people are saying

Observed

DailyDarkWeb explicitly describes the material as an unverified threat actor claim, not confirmation of a breach. It also says Sunnybrook had not publicly confirmed an incident at the time of the post.

Evolution

Alleged

According to DailyDarkWeb, ScarlettGroup first named Sunnybrook in an October 29 listing that provided no data volumes or detailed categories. The newer advertisement adds purported counts, data types and samples, making the allegation more specific without independently proving it.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The advertised material allegedly includes health card numbers, Social Insurance Numbers, insurance details, patient portal messages, PINs, passwords, security questions, emails, staff human resources data and source code. No independent technical validation or forensic evidence is provided in the cited item.

Sources and evidence

Observed

The available evidence is a single DailyDarkWeb post on X with an attached image and a summary of a purported dark web listing. There is no cited statement from Sunnybrook, no independently examined dataset and no second source corroborating the actor’s assertions.