Great Bay Bio
September 20, 2026
•[ ransomware, healthcare ]
Great Bay Bio was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Healthcare. Country: Hong Kong. Website: greatbay-bio.com.
Alabama Woman's Health Care
September 20, 2026
•[ ransomware, leak, healthcare ]
Alabama Woman's Health Care was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Healthcare. Country: United States of America. Website: alabamawomenshealth.com. Alabama Woman's Health Care
Comprehensive Consultative Medicine, Wellbeing and Aesthetic Care Organization
Several thousand documents of employees and clients and an archive of photos
420 Lowell Dr
Suite 400
Huntsville, AL 35801 [Sector: Medical, Other]
arsrenacer.com
September 1, 2026
•[ ransomware, healthcare, finance ]
arsrenacer.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Argentina. Website: arsrenacer.com. ARS RENACER, S.A. DUMP: ANALYSIS OF A HEALTH INSURANCE COMPANY LEAK
ARS Renacer, S.A. (Dominican Republic) is a private Health Risk Administrator (ARS), licensed by SISALRIL (Law 87-01). Member of ADIMARS. It serves hundreds of thousands of affiliates through 24 regional offices.
**DUMP VOLUME:** 274,404 files / 158,693 critical and high-risk files
50,894 files in the "Usuarios" (Users) folder user accounts for all systems
.ssh/ + .bash_history + .gitconfig access keys and command history of IT personnel
4,501 files direct affiliate databases (names, cdulas [national IDs], phone numbers, addresses)
3,000 backup files potentially complete database dumps
679 files employee payroll data
500 files passwords and access tokens to financial systems
**MEDICAL DATA (PHI):**
19,443 medical service authorization files diagnoses, procedures, patient names
13,928 pre-certification files
810 pre-certification files (treatment details)
199 medical record files (expediente clnico)
1,569 prescription files linked to diagnoses
252 claims files containing PHI
**FINANCIAL DATA:**
4,863 financial transaction files payments, refunds, bank details
3,676 account files with affiliates' financial data
3,467 financial documents (reports, balance sheets, budgets)
1,293 files containing financial system secrets and tokens
**REGULATORY RISKS:**
Law 172-13 (Personal Data Protection) Article 13 directly violated; penalties: 6 months to 2 years in prison + fines up to 150 minimum wages per incident
Law 42-01, Article 28 (Confidentiality of clinical records)
Law 53-07 (Cybercrime) mandatory DICAT investigation
Circular SSRL-INT-2025-000827 SISALRIL direct requirement to protect PHI
Precedent: SISALRIL fine of 2.3 million DOP for 5 incidents (2021); the current leak is orders of magnitude larger
**OTHER RISKS:**
Exploitation of the Traspaso Digital system (SISALRIL, 2025) for massive illegal transfers of affiliates using leaked credentials
Blackmailing patients with the threat of disclosing diagnoses
BEC (Business Email Compromise) attacks on management (Board of Directors' data is in the dump)
Synthetic identity theft and fabrication of fake cdulas
Mass Habeas Data lawsuits will paralyze the legal department
The dump contains a complete cross-section of the medical insurance company: from server SSH keys to the diagnoses of hundreds of thousands of patients and affiliates' bank details. The data cannot be invalidated a cdula and medical history are immutable.
TrueCore Behavioral Solutions
September 21, 2026
•[ ransomware, healthcare ]
TrueCore Behavioral Solutions was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Healthcare. Country: United States of America. Website: truecorebehavioral.com. TrueCore Behavioral Solutions is a behavioral treatment provider located in Tampa, FL, specializing in services for at-risk adjudicated youth aged 13-21. Established in 2001, the company is committed to empowering individuals, families, and communities to discover their true potential through quality behavioral health services. They offer residential and outpatient treatment programs that utilize a strength-based approach and evidence-based interventions tailored to the needs of the youth they serve. TrueCore is recognized for its unmatched commitment to helping youth improve their quality of life and achieve personal success.
The company headquarters is located in 1907 US-301, Building C, Suite C150, Tampa, FL 33619, United States. 51-200 Employees
Flex Ltd
September 21, 2026
•[ ransomware, manufacturing, technology ]
Flex Ltd was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: United States of America. Website: flex.com. Flex Ltd. is a global technology manufacturing and supply-chain company headquartered in Austin, Texas. It provides design, engineering, electronics manufacturing, supply-chain management, and infrastructure solutions for customers across the data center, AI, automotive, healthcare, industrial, communications, and consumer technology sectors. Flex operates more than 100 facilities worldwide and employs approximately 150,000 people.
Hudson MD Group, LLC
September 21, 2026
•[ ransomware, healthcare ]
Hudson MD Group, LLC was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Healthcare. Country: United States of America. Website: www.hudsonmdgroup.com. Hudson MD Group, LLC is a U.S.-based multispecialty medical group headquartered in West Orange, New Jersey. Established in 2019, the organization brings together physicians and healthcare professionals across multiple medical specialties and operates a network of outpatient medical practices and care centers throughout New Jersey.
The group provides a broad range of healthcare services, including primary and internal medicine, cardiology, gastroenterology, neurology, obstetrics and gynecology, nephrology, urology, and other specialized medical services. Its integrated practice model allows participating physicians to operate within a shared organizational and administrative infrastructure while maintaining their clinical practices.
Sherman Chan, DDS, Inc.
September 22, 2026
•[ ransomware, healthcare ]
Sherman Chan, DDS, Inc. was listed as a victim on the leak site of the titan ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare.
Grupo Hospifar S.R.L.
September 22, 2026
•[ ransomware, healthcare ]
Grupo Hospifar S.R.L. was listed as a victim on the leak site of the titan ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: Argentina.
Fresenius Medical Care
September 22, 2026
•[ ransomware, healthcare ]
Fresenius Medical Care was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: Germany. You have exactly two days to contact us to prevent publication of all your data containing sensitive information. Deadline: Sep 25, 2026 | Updated: 23 Sep 2026
Clark Hill
September 22, 2026
•[ ransomware, leak, healthcare ]
Clark Hill was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Professional Services. Country: United States of America. [AI generated] Clark Hill (Clark Hill PLC) is a full-service law firm headquartered in Detroit, Michigan, United States. It operates in the legal services industry, providing counsel across practice areas including corporate law, litigation, labor and employment, intellectual property, cybersecurity, government relations, and healthcare law. The firm serves businesses, governments, and individuals through multiple offices across the United States and internationally.
Smart Eye Care
September 23, 2026
•[ ransomware, healthcare ]
Smart Eye Care was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Healthcare. Website: www.smarteyecare.com. Optometrists Stolen data: 7 GB.
Arizona Vascular Medical Equipment, Inc
September 23, 2026
•[ ransomware, healthcare ]
Arizona Vascular Medical Equipment, Inc was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Healthcare. Country: United States of America. Website: arizonavascular.com. Arizona Vascular Medical Equipment, Inc. is a trusted provider of specialized medical devices, focusing primarily on compression therapy solutions and vascular care equipment. Headquartered in Mesa, Arizona, the company is dedicated to improving patient mobility and quality of life by delivering high-quality medical products and personalized customer service across the United States.
www.francare.com
August 18, 2026
•[ ransomware, healthcare, manufacturing ]
www.francare.com was listed as a victim on the leak site of the ZaWoo ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Healthcare. Country: France. Website: www.francare.com. FRANCARE Industries is a French international technical-supply, engineering, and maintenance company, headquartered in Paris, France. The company was founded in 1988 and specializes in supplying equipment, technologies, and technical services to industrial and healthcare customers internationally
welgenone.com
September 24, 2026
•[ ransomware, healthcare, technology ]
welgenone.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Healthcare. Country: United States of America. Website: welgenone.com. Welgen One is a mobile wellness service provider based in Georgia, USA, offering personalized wellness care and dispensary access across Atlanta. The company focuses on delivering innovative healthcare solutions, including remote patient monitoring and onsite wellness programs, to enhance overall well-being. Targeting individuals seeking convenient and comprehensive health services, Welgen One aims to revolutionize the healthcare experience by prioritizing patient-centered care. With a commitment to accessibility and customization, they utilize advanced technology and data to optimize health outcomes
Indroj Medical Group Inc.
September 22, 2026
•[ ransomware, healthcare ]
Indroj Medical Group Inc. was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: United States of America. Website: npiprofile.com. The Web's Free NPI Registry Search & Provider Reference Site
Westside GI
September 22, 2026
•[ ransomware, healthcare ]
Westside GI was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: United States of America. Website: westsidegicenter.com. Ambulatory endoscopy center
pharma5.ma
September 25, 2026
•[ ransomware, healthcare, leak ]
pharma5.ma was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Healthcare. Country: Morocco. Website: pharma5.ma. Pharma5
21, Rue des Asphodles, Marif Extension, 20100 Casablanca, Morocco
05 22 23 62 15
pharma5.ma
Leaked data: 50Gb
Corporate and financial information, data on products and their supply, quality control and certification, drug testing and related issues, employee personal data, counterparties, and much more.
anery.com.br
September 23, 2026
•[ ransomware, healthcare ]
anery.com.br was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Agriculture and Food Production. Country: Brazil. Website: anery.com.br. Somos a Anery Home Care Temos paixo por cuidar Nossa especialidade cuidar de pessoas, com todo o...
taspenlife.com
September 22, 2026
•[ ransomware, leak, healthcare ]
taspenlife.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: Kazakhstan. Website: taspenlife.com. Taspen Life offers a range of insurance products including health protection, group protection, and...
Breast Implant Center of Hawaii
September 25, 2026
•[ ransomware, healthcare ]
Breast Implant Center of Hawaii was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Healthcare. Country: United States of America. Website: breastimplantcenterofhawaii.com. Breast Implant Center of Hawaii is a plastic surgery and aesthetics clinic serving patients across Hawaii. Based in Kailua-Kona, it offers breast augmentation, implant revision, breast lifts, body contouring.
