Hospital El Cruce listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Argentina
• Sector: Healthcare
• Announcement date: January 24, 2025

The Medusa ransomware group has listed Hospital El Cruce on its dedicated leak site, claiming to have compromised a significant amount of data belonging to the institution. According to the announcement made on January 24, 2025, the threat actor group asserts that they have successfully exfiltrated 761.60 GB of information from the healthcare provider.

The details of the claim

On January 24, 2025, the Medusa group officially announced the targeting of Hospital El Cruce. The group claims to have gained unauthorized access to the institution's systems and subsequently stolen data. It is important to note that while the group has made these claims, no screenshots have been provided by the attackers to support or verify the validity of the alleged data leak.

The Medusa group is known to operate as a Ransomware-as-a-Service (RaaS) operation. Publicly available information indicates that this group has been active since 2021. Such groups typically operate by providing ransomware tools to affiliates, who then carry out the actual attacks against various targets to maximize their reach and impact.

Data involved in the incident

Regarding the specific contents of the alleged breach, the group has not disclosed the exact nature of the stolen files. There is currently no information available regarding the specific types of data or the specific files that were purportedly taken. Furthermore, no screenshots have been released to provide visual evidence of the contents of the stolen datasets.

• No specific data types were named in the listing.

About Hospital El Cruce

Hospital El Cruce is a medical institution located in the Buenos Aires province of Argentina. The hospital provides a wide range of medical services to the local population, including advanced diagnostic tests and highly specialized surgical procedures. The institution is a key provider of comprehensive medical services to patients within its region.

Potential impact and organizational risks

This incident may pose a significant risk of exposing sensitive patient records and employee information. Because the Medusa group utilizes double-extortion tactics, the potential publication of such data could lead to substantial operational and reputational damage for the institution. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data but also threaten to leak sensitive information on public forums if a ransom is not paid. This places immense pressure on the victim, as the threat of data exposure remains even if systems are restored from backups.

The organization may also face legal obligations under Argentine data protection regulations, which could potentially result in administrative penalties. Beyond the legal and regulatory consequences, the leaked data could potentially be utilized by malicious actors for identity theft or targeted phishing campaigns against the individuals involved.

For organizations operating within the healthcare sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Protecting sensitive medical data requires a multi-layered defense strategy. Common defensive steps for organizations include implementing strict access controls, maintaining regular and offline backups, conducting regular security awareness training for staff, and ensuring that all software and systems are promptly patched against known vulnerabilities. Maintaining a strong incident response plan is also essential to mitigate the impact of such breaches when they occur.