Inversiones Clinica Del Meta SA targeted by Medusalocker ransomware group

• Ransomware group: medusalocker
• Country: Colombia
• Sector: Healthcare
• Announcement date: February 28, 2025

Medusalocker claims data breach at Inversiones Clinica Del Meta SA

The Medusalocker ransomware group has listed Inversiones Clinica Del Meta SA on its leak site, claiming to have successfully exfiltrated a significant amount of sensitive information. According to the announcement made on February 28, 2025, the threat actors claim to possess a vast repository of data belonging to the Colombian healthcare provider. This development highlights the ongoing targeting of medical institutions by ransomware operators seeking to exploit the sensitive nature of healthcare data.

The group's announcement, which coincides with the claimed date of the attack, suggests a highly organized operation. By publishing the victim's name and the volume of stolen data on a public leak site, the group employs a common pressure tactic designed to force the victim into compliance through public exposure and reputational damage.

Details of the alleged theft and ransom demand

According to the claims made by the Medusalocker group, the stolen dataset is approximately 69.4 GB in size and consists of 81,166 files. The threat actors have set a ransom demand of 100,000 USD to prevent the release or to facilitate the return of the data. The announcement specifies that the group intends to sell the stolen information to a single buyer, and the deal may include various options for generating profit from the files.

This approach is a hallmark of double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. If the victim refuses to pay the ransom to restore their systems, the attackers threaten to leak the stolen information publicly. This dual-threat strategy increases the pressure on organizations, as the risk of data exposure often outweighs the operational downtime caused by encryption alone.

Data types identified in the leak

Based on the screenshots provided by the threat actors, the leaked information appears to include a wide range of sensitive administrative and personal documents. The data allegedly contains:

• Employee information
• Patient information
• Agreements
• Password data
• Appointment information
• Identification documents
• Birth certificates

The presence of such diverse data types, ranging from administrative agreements to highly personal identification and birth certificates, indicates a deep penetration into the organization's file directories.

Implications and risks for the healthcare sector

The alleged leak of this information poses significant risks to the privacy of both patients and employees of Inversiones Clinica Del Meta SA. Because the organization operates within the healthcare sector, the exposure of such sensitive data could lead to serious legal consequences under Colombian data protection regulations. Medical records and personal identification are among the most sensitive forms of data, and their loss can have long-lasting impacts on the individuals involved.

The inclusion of password data is particularly concerning, as it may increase the risk of secondary attacks against the organization's systems. If attackers obtain valid credentials, they can potentially maintain persistence within the network or escalate their privileges. Furthermore, the presence of identification cards and birth certificates significantly heightens the risk of identity theft for the affected individuals, as these documents are primary components used in fraudulent activities.

For organizations in the healthcare sector, defending against such threats requires a multi-layered security approach. Implementing robust access controls and multi-factor authentication can help mitigate the risk of credential-based attacks. Regular security audits, comprehensive data encryption, and strict adherence to regional data protection laws are essential defensive steps. Additionally, maintaining offline, immutable backups is a critical component of a resilient incident response strategy to ensure that operations can be restored without paying ransoms to threat actors.