krybit ransomware group lists dhli.in on its leak site

• Ransomware group: krybit
• Country: India
• Sector: Healthcare
• Announcement date: July 22, 2026

Krybit claims data breach at Delhi Heart & Lung Institute

The Delhi Heart & Lung Institute (dhli.in) has been listed in a recent leak announcement by the threat actor known as krybit. According to the announcement posted on the group's leak site, the organization has been targeted in a cyberattack, with the group claiming to have obtained a significant amount of data from the institution.

The announcement, which was made on July 22, 2026, suggests that the threat actor is moving toward a phase of data exposure. In modern ransomware operations, groups often employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. The threat of releasing this stolen information on a public leak site serves as additional leverage to pressure the victim into meeting ransom demands.

Details of the claimed attack

The threat actor known as krybit has announced the upcoming release of data belonging to dhli.in on their leak site. The announcement claims that a dataset of 22 GB has been obtained from the institution. While the group has made this claim, information regarding this specific group remains limited in the public domain, making it difficult to ascertain their full capabilities or typical patterns of operation.

The claim of a 22 GB dataset indicates a substantial volume of information has been targeted. However, the specific types of data allegedly compromised are not detailed in the announcement, which only specifies the total size of the stolen information. The listing does not provide information regarding a ransom demand or the specific files involved in the breach.

Organization profile

The Delhi Heart & Lung Institute (DHLI) is a 100-bedded tertiary care super specialty hospital established in 2003. It provides specialized healthcare services for heart and lung diseases in New Delhi, India.

Risk assessment and sectoral implications

As the institution is a healthcare provider, the alleged data breach may pose a high risk to patient confidentiality. The potential exposure of personal health information could lead to secondary risks such as identity theft. Furthermore, such incidents in the healthcare sector may disrupt the institution's operational processes and result in significant reputational damage.

Beyond the immediate operational impact, the institution may face legal obligations under Indian data protection regulations due to the nature of the sensitive information handled by medical facilities. When healthcare entities are targeted, the sensitivity of the data involved often elevates the severity of the incident compared to other sectors.

To defend against such threats, organizations in the healthcare sector typically implement various defensive measures. These include robust encryption for data at rest and in transit, strict access controls to limit the exposure of patient records, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, maintaining offline backups and conducting regular security awareness training for staff are fundamental steps in mitigating the impact of ransomware and data theft attempts.