Benzona claims to have stolen data from sevci.org

• Ransomware group: benzona
• Country: Côte d’Ivoire
• Sector: Healthcare
• Announcement date: November 26, 2025

Benzona claims a major data breach at sevci.org

The threat group known as benzona has recently listed a significant amount of data on their leak site, claiming the information belongs to sevci.org. According to the announcement, the group has successfully targeted the healthcare organization, asserting that a substantial volume of data has been exfiltrated from their systems.

Ransomware groups often utilize leak sites as a method of double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to pressure the victim into paying a ransom. By threatening to publish the stolen data publicly, these groups aim to maximize the psychological and reputational pressure on the target organization.

Details of the claimed attack

The announcement regarding the incident was published on November 26, 2025. The benzona group presented this event as a direct threat to the healthcare operations of the institution. While the group has made these claims, public information regarding the specific methods, infrastructure, or background of the benzona group remains limited.

The group's post serves as a public notification of the alleged breach, though the group's identity and specific motivations remain largely obscured in the public domain. Such incidents highlight the persistent threat posed by ransomware actors who target critical infrastructure and essential services to ensure maximum leverage during negotiations.

Data involved in the alleged leak

According to the claims made by the benzona group, the volume of stolen information is quite significant. The group asserts that a total of 500 GB of data is currently available on their leak site. Despite the large size of the alleged data set, the group has not provided any specific details regarding the contents of the files.

• The listing names no specific data types or file categories.

At this time, no screenshots or detailed lists regarding the specific content of the leaked data have been provided by the attackers. There is no information available regarding the exact number of files involved or the specific nature of the documents contained within the 500 GB of data.

Organizational profile: SEVCI

The target of this alleged attack is SEVCI (Santé, Espoir et Vie), a healthcare organization based in Côte d’Ivoire. SEVCI is an organization that aims to improve public health by providing various healthcare services to the population.

Potential risks and industry implications

The alleged leak poses a significant risk of exposure for sensitive health data maintained by sevci.org. Depending on the specific data protection regulations applicable in the institution's region, such an incident could lead to various legal and administrative consequences for the organization. The exposure of medical or personal information can trigger mandatory reporting requirements and regulatory scrutiny.

Beyond the immediate organizational impact, the exposed data may create secondary risks for both employees and patients. These risks include the potential for identity theft or the execution of highly targeted phishing attacks, where attackers use stolen personal details to gain trust and further compromise individuals.

Furthermore, incidents targeting healthcare institutions can result in significant operational disruptions and potential reputational damage. For organizations in the healthcare sector, maintaining the confidentiality of patient data is a cornerstone of trust. To defend against such threats, organizations typically implement defensive measures such as robust encryption, multi-factor authentication, regular security audits, and comprehensive employee training to mitigate the risk of initial access and subsequent data exfiltration.