Medasa listed on Qilin ransomware leak site following claims of a data breach

• Ransomware group: Qilin
• Country: Spain
• Sector: Healthcare
• Announcement date: February 3, 2026

Qilin ransomware group claims data breach at Medasa

The Qilin ransomware group has officially listed the healthcare organization Medasa on its dedicated leak site. Through this announcement, the threat actor group alleges that they have successfully conducted a data breach against the organization. This development follows a pattern of behavior observed in modern cyber extortion campaigns where groups target sensitive sectors to maximize leverage.

The group added Medasa to its leak platform on February 3, 2026. According to the claims made by the attackers, they have acquired the organization's data and have issued threats to publish the information publicly. To support their claims, the group has provided screenshots that display various samples of documents, which they suggest are part of the stolen dataset.

Details of the alleged data theft

While the group has provided visual evidence of the breach, the full scope of the incident remains unclear. At this time, detailed information regarding the total volume of the leaked data or the specific file count is not available. Furthermore, the group has not disclosed a specific ransom demand or a specific amount of money required to prevent the publication of the data.

Based on the screenshots provided by the attackers, the information involved in the breach appears to include several types of documentation. The specific items identified in the samples include:

• Internal reports
• Graphical data
• Text documents

It is important to note that while these samples have been provided, the complete extent and nature of the entire dataset have not been detailed in the public announcement.

About Medasa

Medasa is a healthcare services and medical equipment supplier based in Mexico. The company operates in the field of medical devices and supplies for hospitals and clinics, serving as a key provider within the medical supply chain.

Risk assessment and industry implications

This incident highlights the significant risks associated with the exposure of sensitive healthcare data. Because the organization operates in Spain, the breach could potentially lead to legal consequences under the General Data Protection Regulation (GDPR) of the European Union. The involvement of a healthcare entity increases the potential impact on both the organization and the individuals whose data may be at risk.

The tactics employed by the Qilin group appear to align with the double extortion method. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to leak it if the ransom is not paid. This approach creates secondary risks for employees and patients, including the potential for identity theft or highly targeted phishing attacks using the stolen information.

The history of the Qilin group suggests that attacks targeting the healthcare sector can lead to significant disruptions in operational continuity. For organizations operating in this critical sector, maintaining robust cybersecurity postures is essential. Common defensive strategies often include implementing strict access controls, maintaining offline backups, and conducting regular security audits to mitigate the risk of such high-impact breaches.