Lockbit5 ransomware group lists amorsaude.com.br on its leak site

• Ransomware group: Lockbit5
• Country: Brazil
• Sector: Healthcare
• Announcement date: September 9, 2026

The LockBit ransomware group has listed the Brazilian healthcare organization amorsaúde.com.br on its dedicated leak site. According to the announcement made by the group, the organization has been targeted in a cyberattack that has resulted in a data breach.

Details of the claimed attack

The announcement regarding the compromise of amorsaúde.com.br was discovered on September 9, 2026. While the listing was identified in September, the group claims that the actual attack took place on August 22, 2026. The threat actors claim to have successfully gained access to the networks belonging to the organization.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data. The threat of releasing this stolen information on a public platform is used to pressure the victim into paying a ransom. If the ransom is not met, the group threatens to publish the data, causing significant operational and reputational harm.

Data involved in the breach

Despite the listing on the leak site, the group has not shared specific details regarding the nature of the leaked data. The provided screenshot associated with the announcement consists only of a general platform logo, offering no visual evidence of the stolen files. Consequently, the listing names no specific data types.

Organization profile

AmorSaúde is a large network of popular clinics in Brazil that provides medical and dental services. The organization is a healthcare entity aimed at facilitating access to affordable medical care for its patients.

Risk assessment and implications

Because the organization operates within the healthcare sector, there is a possibility that the leaked data includes sensitive patient information or personal health records. Such a breach poses significant risks to the organization, including potential legal sanctions under Brazil's LGPD regulations and substantial reputational damage. The exposure of medical data is particularly sensitive due to the private nature of health information.

Considering the past activities of the LockBit group, it is possible that the leaked data could be used in secondary attacks or identity theft attempts. There is a potential risk of targeted phishing attacks directed at the organization's customers and employees. Threat actors often use stolen credentials or personal details to craft highly convincing social engineering campaigns.

To defend against such threats, organizations in the healthcare sector typically focus on implementing robust security frameworks. Common defensive steps include maintaining strict access controls, implementing multi-factor authentication, and ensuring regular, offline backups of critical data. Continuous monitoring of network traffic and employee training on phishing awareness are also standard practices to mitigate the risk of unauthorized access and subsequent data exfiltration.

Public information regarding the specific activities and capabilities of this group remains limited.