Centromedicoenova targeted by Cloak ransomware group

• Ransomware group: Cloak
• Country: Spain
• Sector: Healthcare
• Announcement date: January 30, 2025

Cloak group claims data leak at Centromedicoenova

The Cloak ransomware group has announced a data leak involving Centromedicoenova, a medical center located in Spain. According to the announcement posted on the group's leak site on January 30, 2025, the threat actor claims to have exfiltrated data belonging to the healthcare provider. This claim follows a pattern often seen in modern cyberattacks where groups use public leak sites to pressure victims.

In many ransomware scenarios, threat actors employ a tactic known as double extortion. In this method, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information before the encryption occurs. The threat actors then threaten to publish this stolen data on public forums or dedicated leak sites if the ransom demands are not met. This strategy aims to maximize leverage by threatening the victim's reputation and legal standing through the exposure of private information.

Details of the claimed event

The announcement regarding Centromedicoenova was made on January 30, 2025, which is the same date the group claims the attack took place. The Cloak group asserts that the volume of the compromised data is less than 100 GB. At this stage, public information regarding the specific operations and identity of the Cloak group remains limited, making it difficult to establish a broader pattern of their activities.

Regarding the specific contents of the breach, the listing does not provide a screenshot or a detailed inventory of the files. Consequently, the specific nature of the leaked data cannot be determined from the available information. Furthermore, the group has not provided any information regarding a ransom demand or the specific file count involved in the incident.

Organization profile

Centromedicoenova is a medical center based in Valencia, Spain. The institution provides healthcare services across various medical specialties, serving the local community through a range of specialized medical care.

Risk assessment and sector implications

This claim may pose a significant data breach risk for an organization operating within the healthcare sector. Because healthcare providers handle sensitive information, they are frequent targets for cybercriminals. Depending on the actual nature of the data involved, the institution could potentially face legal implications under GDPR (EU) regulations, which govern the protection of personal data within the European Union. The accuracy of the reported data volume has not yet been verified by independent sources or the organization itself.

A potential leak of medical or personal information may lead to various secondary risks. These include the possibility of identity theft or the execution of highly targeted phishing attacks against patients or staff members. In such attacks, criminals use stolen information to craft convincing messages to trick individuals into revealing further credentials or financial details.

To defend against such threats, organizations in the healthcare sector typically focus on several defensive layers. These include implementing robust access controls, maintaining regular offline backups, and ensuring that all software systems are patched against known vulnerabilities. Additionally, continuous monitoring of network traffic and employee training on phishing awareness are standard practices used to mitigate the risk of initial entry and subsequent data exfiltration.