Hospital de la Santa Creu i Sant Pau listed on thegentlemen leak site

• Ransomware group: thegentlemen
• Country: Spain
• Sector: Healthcare
• Announcement date: October 3, 2026

The threat actor known as thegentlemen has listed the Hospital de la Santa Creu i Sant Pau on their leak site. This announcement follows a claim that the institution's network was accessed and data was exfiltrated.

The claimed attack event

According to an announcement published on October 3, 2026, the group known as thegentlemen claims to have targeted the Hospital de la Santa Creu i Sant Pau. The group alleges that they successfully gained access to the institution's network and subsequently exfiltrated data from the system. While the group has made this public claim, information regarding the specific identity and background of the thegentlemen group remains limited.

The timeline provided by the threat actor suggests the intrusion occurred shortly before the public announcement. In such scenarios, ransomware groups often use leak sites to pressure organizations by threatening to release stolen information. These sites serve as a platform for the attackers to claim responsibility and demonstrate the success of their operations to the public and the victim.

Details regarding the leaked data

At this stage of the incident, the threat actor has not provided specific details regarding the nature of the compromised information. No information or screenshots regarding the nature of the leaked or compromised data have been provided by the group. Furthermore, the listing does not specify the volume of data involved or the total number of files that were allegedly accessed during the breach.

The listing names no specific data types that have been compromised.

The organization profile

Hospital de la Santa Creu i Sant Pau is a historic academic hospital located in Barcelona. Founded in 1401, the institution is recognized for its significant architectural heritage and is a UNESCO World Heritage site. Beyond its historical importance, the institution provides modern medical services and conducts clinical research.

Implications and potential risks

This claim suggests that sensitive data belonging to a healthcare institution may have been compromised. If the data is indeed exposed, the confidentiality of patient health records could be violated, which could potentially lead to legal consequences under GDPR. The exposure of such sensitive information poses significant risks to the individuals involved.

Employees and patients may face secondary risks resulting from a breach of this nature, such as identity theft or targeted phishing attacks. Such attacks often leverage stolen information to deceive individuals into revealing further credentials or financial details.

Furthermore, any disruption to healthcare services resulting from a cyberattack could negatively impact the institution's operational processes. In the context of modern medicine, the continuity of digital services is vital for patient care and hospital management.

If the threat actor employs a double-extortion strategy, it is possible that a ransom demand may be issued to prevent the publication of the data. Double extortion is a common tactic where attackers not only encrypt systems but also steal sensitive data, threatening to leak it unless a ransom is paid. To defend against such threats, organizations typically implement robust security measures, including regular data backups, multi-factor authentication, and continuous network monitoring to detect unauthorized access early.