On 3 November 2026 leak-feed relays listed four new claimed victims of the Booba Project ransomware group, among them a city government named City of Edgewater and a park district. These are the group’s own claims. We have not seen a statement from either body, and a listing does not prove that data was taken.
Brandefense Blackhole holds 225 Telegram posts that match “Booba” since August. This story counts what they say about one group: 47 different claimed victims, 11 of them government bodies. All counts below come from our saved Blackhole search.
How Many Victims Has the Booba Project Ransomware Group Claimed?
Of the 225 posts, 175 contain “Booba Project” and 42 contain “booba team”, which two channels use for the same group. The other 8 are not victim listings: 6 are statistics or summary posts from one ransomware-tracking channel, 1 is a crypto token signal and 1 is a crypto wallet list. Across five relay channels, the group posts carry 47 different victim names once spelling variants are merged.
The same victim often appears in four or five relays within minutes, so the post count is not the victim count. We counted names, not posts. Month counts use the time of the first post for each victim (post created_at); our seen and inserted times fall within about 15 minutes of it for every post.
The earliest posts in our window carry a relay date of 28 July 2026 for the claim itself. Our search starts on 1 August, so we cannot say what came before. Our reading is that October is a step up. Claims arrive in batches, with 6 on 20 October, 9 on 27 October, 7 on 29 October and 4 on 3 November.
- Group names in relays.
- Booba Project, booba team.
- Posts matched.
- 225, of which 175 say “Booba Project” and 42 say “booba team”.
- Unique claimed victims.
- 47 after merging name variants.
- Government bodies.
- 11 by relay description, 12 with a park district.
- Largest batch days.
- 20 Oct 6, 27 Oct 9, 29 Oct 7, 3 Nov 4.
- Confirmation by victims.
- None seen by us in our data.
Which Sectors Does the Booba Project List Cover?
Sector comes from the description line that one relay attaches to each entry, grouped by us. Healthcare is the largest group with 15 entries: practices, hospitals and medical suppliers. Government and public bodies follow with 12: 11 by relay description, plus a park district that the relay files under recreation, which is our reading.
Education has 5 and law firms 3. The remaining 12 are small firms and organisations in manufacturing, insurance, travel, veterinary services and similar fields.
We name public bodies below and no private company. Listings against private firms are unverified claims, and none of them is a widely reported breach. For the same reason we give sector only.
Why Is Local Government the Part to Watch?
The government share rose over time. Before 20 October the relays carried 21 claimed victims, 3 of them government bodies, or 14 percent. From 20 October to 3 November they carried 26, with 8 government bodies, or 31 percent, and 35 percent if the park district counts.
The public bodies named include Merrimack County, Washington County, City Hall in Everett, MA, the City of Mt. Angel, Oregon, the City of Big Spring, South Weber City, Terrebonne Parish Government and the City of Edgewater. A township, a police department and a Brazilian foundation make up the rest. Of the 11, relays label 5 as US and 1 as Brazil; the other 5 carry no country, though their names read as US local bodies in our reading.
Each of these is a listing on a group’s page that a relay copied. Everett is a case where we hold only the relay entry dated 20 October 2026, and we draw no link to any other event in that city. Edgewater, the 3 November listing, came with the same short description line and no sample.
Which Countries Appear in the Booba Project Listings?
Only 32 of the 47 entries carry a country label in the relays, and the labels come from different sites and are not always reliable. Of the 32, 25 read US. Canada has 2, and Brazil, Italy, Spain, Switzerland and the United Kingdom have 1 each. One label does not fit the organisation’s name, so treat the split as a rough guide.
How Big Is Booba Next to Other Groups?
A ransomware-tracking channel in our data posted a weekly report on 2 November 2026. It lists “Booba” with 16 attacks, third behind The Gentleman with 50 and Qilin with 30, out of 243 in total. That is the channel’s count, not ours.
For those two larger groups see our profiles of The Gentlemen ransomware group and the Qilin ransomware group. Booba Project is small by comparison, and our data cannot say how many of its listings are true.
What Should Local Governments Do Now?
The steps below are our advice and apply whether or not any single claim is true. Small cities and counties run lean IT teams, so the list starts with the exposures that ransomware groups use most. A smaller attack surface helps first.
- Patch edge devicesUpdate VPN, firewall and remote access gateways, and close any service that does not need to face the internet.
- Require MFAPut multi-factor sign-in on VPN, email and admin accounts, and reset passwords of staff whose credentials appear in stealer logs.
- Test backupsKeep one copy offline and restore a payroll or records system in a test run, with a timed result.
- Check your own logsIf a group names you, review remote access and backup logs before you reply to anyone.
- Prepare the noticeDraft a public statement and a contact list in advance, so residents hear from the city first.
- Watch for your nameMonitor leak-site relays for your body and its suppliers. Brandefense Blackhole does this for dark web sources.
Method and Limits
All figures come from the saved Blackhole search for “Booba Project”, “Booba” and “Frag ransomware”, dated 1 August to 3 November 2026. We merged name variants of the same victim, so 53 raw names became 47. Sector and the government grouping are our reading of the relay description; the country is the relay’s label.
We did not open the group’s own site, and we link no leak page, handle or file. The group’s start date and any municipal incident lie outside this data, so we make no claim about either. A statement from a listed body outranks this story.