A ransomware group called Booba Project has reportedly listed Pearland Pediatrics, a Texas pediatric practice, as a victim and claimed to hold 35 gigabytes of data. The practice has not publicly confirmed a breach, and the scope of any exposure is unknown.
Pearland Pediatrics’s Data Breach Investigation
Pearland Pediatrics is a pediatric healthcare practice based in Pearland, Texas, that serves families across the greater Houston area. A practice like this keeps records for children and for the parents or guardians who manage their care, so a single incident can reach more than one generation of a household. Current and former employees also appear in a practice’s files.
On October 20, 2026, a ransomware and data-extortion group that calls itself Booba Project reportedly added Pearland Pediatrics to its leak site. Tracking services that monitor those postings recorded the listing the same day, and security blogs repeated it. The group’s entry reportedly claims about 35 gigabytes of stolen data and categorizes the victim as a hospital and health care organization. The plaintiff-side resource ClassAction.org has noted that attorneys are investigating the reports. This page treats all of these items as claims and an investigation, not as established facts.
Pearland Pediatrics has not publicly confirmed that its systems were breached. No notice letter, regulatory filing or company statement describing an incident turned up in the sources reviewed. Those sources also do not say how an intruder would have gotten in, which systems were involved, whether data was actually copied, or whether patient care or scheduling was disrupted. One report on the listing noted that it offered no sample of allegedly stolen files, no file listing and no technical evidence of the nature of the incident.
No count of affected people has been published. The size of the claimed archive is not a headcount, and a figure measured in gigabytes cannot be converted into a number of patients. This page therefore does not estimate how many people may be involved. It also does not list specific data types as exposed, because the listing does not itemize what the group says it holds and ClassAction.org lists the impacted data as still to be determined.
A leak-site listing and a legal notification duty are different things. Extortion groups post victims to pressure them into paying, and a listing by itself is not proof that a breach occurred. A practice’s duty to notify patients generally begins when its own investigation determines that personal information was accessed or acquired, and that work can take weeks or months. A public claim by an attacker often appears long before any official notice. Some claims are later shown to be exaggerated, while others are confirmed in full.
If the claim proves accurate, the kind of information a pediatric practice keeps is a real concern. Patient files can include a child’s name, home address, date of birth, parent or guardian names, insurance member details, billing and payment records, immunization histories, diagnoses and visit notes. Parents may also have provided their own Social Security numbers or driver’s license details for billing. That is general context about the industry, not a statement about what Pearland Pediatrics held or what was taken. Information of this kind can enable identity theft, insurance fraud and scam messages that cite a real appointment or a child’s real care.
A child’s information carries a particular long-term risk. Children rarely check their credit, so misuse of a young person’s identity can go unnoticed for years, sometimes until they apply for a loan, a job or a student account as adults. Healthcare providers are also a frequent target of extortion groups because patient records are sensitive and the pressure to keep the office running is high. For those reasons, parents who have taken a child to Pearland Pediatrics may want to know whether the practice has been named in an incident.
At this stage, nobody needs to take drastic steps, but a few sensible precautions cost little. Watch for any notice from the practice, and be cautious with unexpected calls, texts or emails about appointments, balances or insurance. Confirm any request for payment by phone, using a number you already trust. Consider reviewing your own credit reports and your insurance statements, and ask the credit bureaus how to place a freeze on your child’s credit file. If a notice does arrive, it will be the best source for what happened to your information.
This page will be reviewed if the practice, a regulator or a reliable news outlet publishes more detail. A claim by an extortion group is not a finding about fault, and whether the practice’s safeguards were adequate remains an open question. Those are the kinds of questions attorneys can ask on behalf of people who were harmed if the claim is confirmed.
When Did This Breach Occur?
The leak-site listing was recorded by monitoring services on October 20, 2026. The sources reviewed do not say when any intrusion may have taken place, and Pearland Pediatrics has not announced a timeline. The date of the listing is not necessarily the date of any incident.
If you receive a notice, its own dates and description will be the most reliable record of the timeline for your information.
What Information Was Breached?
No specific data types have been confirmed. The listing as summarized by trackers claims a quantity of data but does not say which records are involved, and ClassAction.org lists the impacted data as to be determined.
Because nothing has been confirmed, it is prudent to watch for a notice that will state which details, if any, were involved.
What You Can Do
If you received a notice related to Pearland Pediatrics or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Be cautious with emails, texts or calls about appointments, balances or insurance, and verify any request for payment by phone using a number you already trust.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Pearland Pediatrics
If you are notified that your personal information or your child’s information was exposed in an incident involving Pearland Pediatrics, you may have legal options. Companies and medical practices are expected to safeguard the sensitive information entrusted to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
