DomusVi · Breach

[Single source] Black X claims theft of elder-care giant DomusVi client data

Nov 09, 2026 · 1 min read

The Black X extortion group listed DomusVi, one of Europe's largest elder-care and nursing-home operators, with 500+ residences in France, Spain, Portugal and other countries. The group claims to hold data on clients and their primary contacts, including medical record numbers and bank account numbers. DomusVi has not confirmed a new incident and no samples have been released.

By HIFY Radar newsroom Updated 11/09/2026 04:11 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

The Black X extortion group has listed DomusVi, one of Europe's largest elder-care and nursing-home operators with more than 500 residences in France, Spain, Portugal and other countries, on its leak site. The group claims to hold data on clients and their primary contacts, including medical record numbers, names, phone numbers, emails, home addresses and bank account numbers.

Observed

DomusVi has not confirmed a new incident and no samples have been independently verified. This should be treated as an unverified threat-actor claim, not confirmation of a breach.

What happened

Alleged

The Black X extortion group added DomusVi to its leak site, publicly claiming to have stolen data belonging to the elder-care provider's clients and their primary contacts.

Alleged

According to the claim, the stolen data set includes medical record numbers, names, phone numbers, email addresses, home addresses and bank account numbers. DomusVi has not confirmed a new incident, and no data samples have been independently verified.

Observed

DomusVi previously disclosed a Hive ransomware attack in November 2022, so the company has a documented history of being targeted by ransomware operators.

Why it matters

Inferred

If the claim is real, elderly residents and their families could face targeted fraud, including fake care-billing scams and direct-debit fraud exploiting the exposed bank account details.

Inferred

The alleged combination of medical record numbers, personal contact details and financial data is particularly sensitive for a vulnerable population of elders and their relatives, raising the risk of convincing social-engineering attacks.

What to do

Observed

Treat the listing as an unverified threat-actor claim rather than confirmation of a breach, pending a statement from DomusVi or independent verification of samples.

Inferred

DomusVi clients and their primary contacts should be alert to fake care-billing requests and unexpected direct-debit changes, verifying any billing or payment communication through official channels.

Confirmed and still uncertain

Observed

Known: Black X has listed DomusVi on its leak site and claims to hold client and contact data including medical record numbers and bank account numbers; DomusVi disclosed a Hive ransomware attack in November 2022.

Observed

Unknown: whether a new breach actually occurred, the volume and authenticity of the claimed data, when the alleged intrusion took place, and whether any ransom demand or extortion deadline has been issued. DomusVi has not confirmed the incident and no samples have been verified.

What people are saying

Observed

The dark-web monitoring account DailyDarkWeb publicized the listing, warning that if the claim is real, elderly residents and their families face targeted fraud and stressing that the report reflects a threat-actor claim, not a confirmed breach.

Observed

DomusVi has not issued a confirmation of a new incident, and no independent verification of the claimed data has been reported.

Evolution

Alleged

The claim emerged when Black X added DomusVi to its leak site, escalating from private extortion to public exposure. No timeline for the alleged theft or any subsequent developments has been established.

Observed

This is not DomusVi's first encounter with ransomware: the company previously disclosed a Hive ransomware attack in November 2022.

Reach

Observed

1 independent groups, 1 updates, and 1 engagements.

Technical detail

Observed

Black X is described as an extortion group that operates a leak site, the standard double-extortion channel where stolen data is published or threatened to be published to pressure victims.

Alleged

The claimed data set is specific: medical record numbers, names, phone numbers, emails, home addresses and bank account numbers, covering both clients and their designated primary contacts. No technical details about the intrusion method have been disclosed.

Sources and evidence

Observed

This report is based on a single unverified source: a post by the dark-web monitoring account DailyDarkWeb on X describing the Black X leak-site listing. No data samples, breach artifacts or company statements have been independently verified.

Observed

The underlying facts about DomusVi's scale and its November 2022 Hive ransomware disclosure are cited from the same post and have not been corroborated by additional sources in this evidence batch.