FEATURED INCIDENT OF THE WEEK
Affected Entity: L&P Aesthetics (fortheface.com)
Leaked Volume: 121.53 GB
Detection Date: September 2026
Incident Analysis
The exposure of a massive repository belonging to the medical firm L&P Aesthetics on underground forums has been confirmed. The leak exposes Protected Health Information (PHI), operational records, and network assets.
Breakdown of Compromised Assets
Based on an inspection of the directory structure, the breach includes:
· Protected Health Information (PHI): .csv records containing consultation requests, procedure schedules, consent forms, and patient identifiers.
· Corporate Communications: Corporate email accounts (info@fortheface.com) and Outlook backup files (.pst) exceeding 26 GB.
· Physical and Operational Infrastructure: Architectural blueprints, municipal permits, IT support manuals, and electrical diagrams.
· Access and IT Management: Documentation regarding the migration from Google Workspace to Microsoft 365, licensing details, and internal spreadsheets containing staff passwords (L&P Passwords (ALL EMPLOYEES).xlsx).
DEEP WEB MONITORING AND OVERVIEW
Scope: General collection of global credentials and access logs
Volume Extracted: 46.29 GB (~925 million log entries)
Affected Countries: United States, United Kingdom, Italy, France, among others
Assessment of General Findings
During continuous monitoring of underground repositories, mass storage servers, and distribution channels, the intelligence team processed multiple data packages (combolists, stealer logs, and URL:LOG:PASS datasets).
Analysis of Collected Data
Based on the sample extracted from logs and Deep Web sources, the following patterns stand out:
· Information Structure: Massive records of simple credentials consisting of combinations of email addresses (including @gmail.com and corporate domains), usernames, passwords, and linked phone numbers.
· Sources of Exposure: Packages compiled by InfoStealer-type malware (such as RedLine, Raccoon, or Vidar variants) and unified collections intended for automated attacks.
What is InsecureWeb?
InsecureWeb is a Dark Web monitoring service that keeps track of recent data breaches and tracks their impact by monitoring the darkest places of the internet.
Our commitment lies in providing top-notch cybersecurity services to our clients. Through continuous monitoring of the dark web and advanced threat detection methodologies, we strive to identify potential breaches promptly, enabling swift response and mitigation efforts. With our state-of-the-art tools and expertise, we prioritize the confidentiality, integrity, and availability of our clients’ data.