Consorci Sanitari Integral & Geseme targeted by Ransomexx ransomware group

• Ransomware group: Ransomexx
• Country: Spain
• Sector: Healthcare
• Announcement date: October 11, 2022

Consorci Sanitari Integral and Geseme listed on Ransomexx leak site

The Ransomexx ransomware group has listed Consorci Sanitari Integral and Geseme on its dedicated leak site, alleging that the organizations have fallen victim to a data breach. This announcement, made on October 11, 2022, follows a pattern common in modern cyberattacks where threat actors use public platforms to pressure victims by threatening to release sensitive information.

Details of the alleged ransomware attack

According to the claims made by the Ransomexx group, the incident occurred on October 11, 2022. The threat actor alleges that they successfully obtained a total of 52.47 GB of data from the targeted entities. While the group has published this information on their leak site, public information regarding the specific identity and operational details of the Ransomexx group remains limited.

In many ransomware scenarios, groups employ a tactic known as double extortion. This method involves not only encrypting an organization's internal systems to disrupt operations but also exfiltrating sensitive data before the encryption occurs. By threatening to publish the stolen data on a public leak site, the attackers aim to increase the pressure on the victim to pay a ransom, leveraging the threat of reputational damage and regulatory scrutiny.

Sensitive information allegedly exfiltrated

The data claimed to have been stolen by Ransomexx includes highly sensitive documents that could pose significant risks to the individuals involved. Based on screenshots provided by the group, the stolen information includes several categories of highly personal data:

• Patient medical records
• Identity documents (DNI)
• COVID-19 test consent forms
• Pharmaceutical research documents

The presence of such diverse data types—ranging from personal identification to medical history and research—highlights the high value that ransomware groups place on healthcare-related targets. When personal identification documents and medical records are compromised, the risk of secondary exploitation increases significantly.

Organization profile: Consorci Sanitari Integral

Consorci Sanitari Integral is a public entity that provides essential healthcare and social services within the Barcelona region. Established in the year 2000, the organization is responsible for managing various hospitals and social care centers, making it a critical component of the regional healthcare infrastructure.

Impact and security implications

The alleged leak of personal health information and identity details carries profound implications for the affected individuals. Such a breach may expose patients and staff to various risks, including identity theft and financial fraud. For institutions operating within Spain, a breach of this nature may lead to significant compliance challenges under the General Data Protection Regulation (GDPR) and local regulations governing health data privacy.

Furthermore, because the affected organization operates within the healthcare sector, the stolen data may be utilized by threat actors in secondary attacks. This includes highly targeted phishing campaigns designed to exploit the specific medical or personal details of the victims to gain further access to systems or to conduct social engineering attacks.

The sensitivity of the documents involved could also result in a loss of operational credibility for the institution. To defend against such threats, organizations in the healthcare sector typically focus on implementing robust defensive measures. These include maintaining rigorous data encryption standards, implementing multi-factor authentication, conducting regular security audits, and ensuring that all staff members are trained to recognize phishing attempts. Given the sensitive nature of medical data, maintaining a strong security posture is vital for protecting both patient privacy and organizational integrity.