THREAT WATCH · September 29, 2026 · RANSOMWARE LISTING

CHAOS Ransomware Group Lists Carolina Asthma in Healthcare Sector

A healthcare organization operating under the domain carolinaasthma.com has been listed on a ransomware tracker maintained by the CHAOS group. The listing was recorded on September 29, 2026. The organization is based in the United States and operates in the healthcare and pharma sector. It employs between 51 and 100 people. No data has been disclosed publicly as of the time of this report.

Key takeaways

• A healthcare organization in the United States was listed by the CHAOS ransomware group on September 29, 2026.
• The listing is a strong signal of compromise but does not confirm data theft.
• No data has been publicly disclosed as of this report.
• Healthcare organizations with 51 to 100 employees remain high-value targets for ransomware groups.

What we know

• The domain carolinaasthma.com appears on a CHAOS ransomware tracker.
• The listing date is September 29, 2026.
• The organization is located in the United States.
• The sector is Healthcare / Pharma.
• The company size is estimated at 51 to 100 employees.
• No data has been disclosed yet by the group.

About the CHAOS group

CHAOS is a ransomware operation that publishes victim names on a public-facing tracker. The group typically lists organizations after claiming to have exfiltrated data from their networks. In some cases, the group later releases stolen files. In other cases, listings remain without any published data. The presence of a name on a tracker is a strong signal of compromise but does not confirm that data was accessed or stolen.

Why this matters for healthcare

Healthcare organizations remain one of the most targeted sectors for ransomware groups. Patient records, billing systems, and clinical data carry high value on underground markets. Small and mid-sized providers often lack the dedicated security teams that larger institutions maintain. This makes them attractive targets for groups that prefer lower-effort intrusions with meaningful financial returns.

Organizations in this size range - 51 to 100 employees - are particularly exposed. They are large enough to hold sensitive data but often operate with limited IT security budgets. A single successful intrusion can disrupt operations for days or weeks while recovery efforts unfold. Regulatory obligations around breach notification add further pressure on leadership teams during an incident.

What to watch next

• Whether CHAOS publishes any data associated with this listing in the coming days or weeks.
• Whether the organization issues a public statement or confirms an incident.
• Whether additional listings from the same group appear in the healthcare sector over the next reporting period.

Recommended actions

If your organization operates in the healthcare sector, consider the following steps:

• Review your exposure to ransomware groups known to target healthcare, including CHAOS.
• Confirm that offline backups are current and tested.
• Verify that endpoint detection and response tools are deployed across all systems.
• Ensure your incident response plan includes a communications component for public disclosure.
• Monitor threat feeds for any data release tied to this listing.

Intel128 will update this entry if new information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.