Misericórdia de Santo Tirso listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Portugal
• Sector: Healthcare
• Announcement date: June 16, 2026

The Qilin ransomware group has listed data allegedly belonging to Misericórdia de Santo Tirso on its leak site. This announcement, made on June 16, 2026, marks a new instance of a threat actor targeting a healthcare provider in Portugal.

The claimed attack event

According to the announcement made by the Qilin group, the threat actor claims to have successfully gained access to the systems of Misericórdia de Santo Tirso. Following this unauthorized access, the group claims to have acquired data from the institution. The announcement was officially posted on the group's leak site on June 16, 2026, which coincides with the date the group claims the attack occurred.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. These sites are used to host lists of compromised organizations, often accompanied by proof of the breach to increase the likelihood of a ransom payment. In many cases, these groups utilize double extortion tactics. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to threaten its public release if the ransom is not met.

Details of the alleged data breach

The information provided by the Qilin group regarding the specific nature and volume of the stolen data remains limited. While the group has posted samples to demonstrate the breach, there is no clear information regarding the full scope and type of the leaked data. Furthermore, no specific details were provided regarding the total size of the data or the exact number of files involved. There is also no information available regarding a specific ransom demand.

The group has released screenshots as evidence of the breach. These screenshots display blurred samples of what are claimed to be the institution's administrative documents and correspondence. Because the samples are blurred, the exact content remains obscured, and the listing names no specific data types in a structured format.

About Misericórdia de Santo Tirso

Misericórdia de Santo Tirso is a charitable organization based in Santo Tirso, Portugal. The institution plays a vital role in the local community by providing a variety of essential services, including healthcare services, elderly care, and social support.

Risks and industry implications

The targeting of a healthcare institution by a group like Qilin, which is known for using double extortion methods, presents significant risks. This situation may bring the risk of leaking sensitive health data or employee information. For a healthcare institution operating in Portugal, such an incident may lead to data breach investigations under the General Data Protection Regulation (GDPR).

Beyond the immediate regulatory concerns, the organization and its patients may face secondary risks, such as identity theft or targeted phishing attacks. The nature of healthcare data makes it a high-value target for criminals due to the sensitive and permanent nature of medical histories and personal identifiers.

The group's past activities suggest that the operational continuity of institutions in the healthcare sector may be disrupted by such attacks. When healthcare providers face ransomware incidents, the ability to deliver critical care and maintain administrative functions can be severely compromised. To mitigate these risks, organizations in this sector often focus on robust defensive measures, such as maintaining offline backups, implementing strict access controls, and conducting regular security awareness training to defend against the initial entry vectors used by ransomware groups.