Cooperativa de Hospitales de Antioquia - COHAN targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: Colombia
• Sector: Healthcare
• Announcement date: April 20, 2026

Qilin ransomware group claims breach of COHAN

The Qilin ransomware group has officially listed the Cooperativa de Hospitales de Antioquia - COHAN on its dedicated leak site. According to the announcement made on April 20, 2026, the threat actors claim to have successfully compromised the systems of the organization and obtained sensitive data. This listing serves as a ransom notice, a common tactic used by modern cybercriminal groups to pressure victims into paying for the non-disclosure of stolen information.

The group typically employs a strategy where they demand a ransom payment in exchange for not publishing the data they have exfiltrated. While the threat actor claims to have gained access to the organization's internal systems, the specific method of entry has not been disclosed in the public announcement. The incident was reported on the same day the group claims to have carried out the attack.

Details regarding the claimed data theft

The information provided by the threat actor includes screenshots that allegedly display various lists of files and data samples purportedly taken from the organization's systems. However, the group has not provided detailed information regarding the full scope or the specific nature of the leaked data. There is no information available regarding the total size of the data stolen or the specific file count involved in the breach. Furthermore, no specific ransom amount has been publicly stated by the group in this instance.

Based on the available information, the following types of data are identified as being affected:

• Personal data

The presence of such data in a breach often indicates that the threat actors have moved beyond simple system disruption and are now focusing on the exfiltration of sensitive information to maximize their leverage during negotiations.

About Cooperativa de Hospitales de Antioquia - COHAN

Cooperativa de Hospitales de Antioquia (COHAN) is a cooperative operating within the healthcare sector. The organization provides essential services to various hospitals and healthcare institutions located in the Antioquia region of Colombia. Its primary focus is on supporting the operational and administrative needs of its member hospitals, making it a central entity for the healthcare infrastructure in its specific region.

Analysis and potential impact of the incident

The Qilin (Agenda) group is a known threat actor that frequently utilizes double extortion tactics. In a double extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This specific group has a history of targeting organizations within the healthcare sector, a sector that is highly attractive due to the sensitive nature of the data it manages.

This incident could result in the exposure of patient and employee data, which may trigger secondary risks such as identity theft. Given the high sensitivity of health-related information, the event may lead to legal repercussions under Colombian data protection regulations. Furthermore, the group's past activities suggest that any leaked data could be utilized in highly targeted phishing campaigns against the organization or its stakeholders.

The potential adverse effects of this breach include significant risks to the organization's operational continuity and the privacy of its patients. When healthcare entities face such threats, it is common for them to implement defensive measures such as enhanced monitoring, multi-factor authentication, and rigorous data encryption to mitigate future risks. The exposure of such data highlights the ongoing challenges faced by healthcare cooperatives in protecting sensitive information against sophisticated ransomware groups.