Alles Lægehus listed on datacarry ransomware leak site

• Ransomware group: datacarry
• Country: Denmark
• Sector: Healthcare
• Announcement date: May 26, 2025

Danish healthcare provider targeted by datacarry

The Danish healthcare provider alles Lægehus has been listed on the leak site of the ransomware group known as datacarry. On May 26, 2025, the threat actor published a notice claiming to have successfully exfiltrated data belonging to the organization. This announcement follows the group's claim of gaining unauthorized access to the organization's systems and compromising its data.

Details of the alleged attack

According to the notice published by the datacarry group, the attack occurred on May 26, 2025. The threat actor alleges that they were able to penetrate the organization's digital infrastructure to access sensitive information. While the group has made this public claim, information regarding the specific identity and operational details of the datacarry group remains limited.

Regarding the specific nature of the information involved in this incident, the listing provides no details regarding the nature of the allegedly leaked data. Furthermore, no screenshots were provided by the threat actor to substantiate the claims, and no information was provided regarding the volume of files or the size of the data exfiltrated.

Organization profile

alles Lægehus is a healthcare provider that offers primary care and general practitioner services across various locations in Denmark. As a provider of essential medical services, the organization manages sensitive information related to patient care and health services within the Danish healthcare system.

Potential risks and industry implications

These claims may pose a significant risk to data privacy, given that the organization handles sensitive health information. In the context of modern cyber threats, ransomware groups often employ a tactic known as double extortion. In this scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to publish it on a leak site if a ransom is not paid.

Under the GDPR regulations applicable within the European Union, a potential data breach of this nature could trigger legal obligations for the organization. The alleged leak may lead to secondary risks for the individuals involved, such as identity theft or targeted phishing attacks directed at employees and patients. Additionally, the threat actor's intent to publish data may negatively impact the organization's reputation and operational processes.

For organizations operating in the healthcare sector, maintaining robust defensive postures is critical. Common defensive steps often include implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Given the sensitive nature of medical data, ensuring strict access controls and encryption for data at rest and in transit is a fundamental component of protecting patient privacy against such threats.