hmsaojose.com listed on leak site by global group

• Ransomware group: global
• Country: Brazil
• Sector: Healthcare
• Announcement date: August 20, 2025

Healthcare institution hmsaojose.com targeted by global group

The healthcare institution hmsaojose.com has been listed on a leak site by the threat actor group known as global. According to the announcement made by the group, it is claimed that a significant amount of private patient data has been compromised during the incident.

Details of the alleged attack

The threat actor group global listed hmsaojose.com on their leak site on August 20, 2025. The group claims to have obtained 1TB of data from the institution's systems. While the group has made this public claim, information regarding the specific identity and background of this group remains limited in the public domain. At this stage, no screenshot has been provided by the attackers to substantiate the claim of the breach.

Compromised information

The leak announcement claims to contain a massive volume of sensitive information. The data said to be involved includes:

• Patient records
• Personal data

The scale of the alleged leak, totaling 1TB, suggests a substantial amount of information has been targeted. The nature of this data poses a significant risk to the individuals involved.

About Hospital Maternidade São José

Hospital Maternidade São José is a hospital and maternity center located in Itajubá, in the state of Minas Gerais, Brazil. The institution provides medical care and obstetric services to patients in the region.

Potential impact and industry implications

The alleged leak may lead to privacy violations due to the exposure of sensitive patient health information. When sensitive medical data is compromised, the individuals whose records are exposed face heightened risks. The compromised data could potentially be utilized for identity theft or targeted phishing campaigns, where attackers use personal details to gain trust or commit fraud.

From a regulatory perspective, the institution may face scrutiny under Brazil's LGPD regarding data protection obligations. Such incidents often necessitate rigorous investigations to ensure compliance with national privacy laws. Furthermore, the institution may observe negative impacts on its operational continuity and the trust established with its patients.

There is a possibility that the group may attempt to pressure the institution into paying a ransom through double extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This creates a dual pressure: the need to restore systems and the need to prevent a data leak.

In the healthcare sector, organizations typically focus on several defensive steps to mitigate such risks. These include implementing robust access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized movements. Strengthening encryption for data at rest and in transit is also a fundamental practice to protect patient confidentiality. Organizations in this sector must remain vigilant against evolving threats to ensure both patient safety and data integrity.