Gastroenterology & Hepatology data allegedly listed for sale by LeakBazaar

• Ransomware group: LeakBazaar
• Country: United States
• Sector: Healthcare
• Announcement date: May 10, 2026

LeakBazaar claims to have stolen data from Gastroenterology & Hepatology

The threat actor known as LeakBazaar has listed a massive database on their leak site, claiming that the information belongs to the healthcare organization Gastroenterology & Hepatology. According to the announcement made on May 10, 2026, the threat group is offering the alleged data for sale on the dark web. While the specific details regarding a ransom demand were not provided in the announcement, the listing represents a significant potential exposure of sensitive medical information.

The incident appears to have occurred well before the public announcement. Based on the information provided by the threat actor, it is suggested that the institution may have experienced a data breach as early as April 17, 2026. This gap between the alleged intrusion and the public listing is a common occurrence in ransomware-related extortion scenarios, where attackers often spend time exfiltrating data before making their demands or publishing the results on a leak site.

Details of the alleged data breach

The LeakBazaar group claims that the stolen dataset is approximately 269 GB in size. The threat actor alleges that this database contains the records of 167,303 patients. This volume of data suggests a highly comprehensive breach of the organization's digital infrastructure, potentially impacting a vast number of individuals within the healthcare system.

The contents of the leaked data are described as being highly sensitive, encompassing both personal identifiers and private medical information. The alleged data includes the following types of information:

• Patient contact information
• Social Security Numbers (SSN)
• Medical diagnosis and medication records
• Pathology reports

Beyond general identifiers, the threat actor claims that the breach includes highly sensitive medical details for a specific subset of the population. Specifically, the group alleges that the records of 49,798 patients with sensitive medical conditions are included in the leak. These conditions reportedly include mental health issues, substance abuse, sexually transmitted infections (STIs), and cancer. The inclusion of such specific diagnoses significantly heightens the sensitivity of the breach.

Risk assessment and implications

This incident may pose a high risk due to the exposure of personal and medical patient data. Because the data includes Social Security Numbers and specific medical diagnoses, the victims face heightened risks of identity theft and targeted phishing attacks. Such attacks often leverage the stolen information to appear legitimate, making it harder for patients to detect fraudulent communications.

As a United States-based healthcare entity, the incident could potentially lead to legal consequences under HIPAA regulations. Healthcare organizations are subject to strict rules regarding the protection of patient privacy, and a breach of this magnitude often triggers mandatory notification requirements and regulatory scrutiny. The presence of sensitive diagnoses within the leaked data may increase secondary risks, as the information can be used for more sophisticated social engineering or extortion attempts against the individuals themselves.

In such scenarios, organizations typically face the challenge of identifying the full scope of the breach and notifying all affected individuals. Defensive measures for healthcare organizations often include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all systems, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration. Information regarding the specific capabilities and background of the LeakBazaar group remains limited at this time.