NeoDerm listed on gunra ransomware leak site

• Ransomware group: gunra
• Country: Hong Kong SAR China
• Sector: Healthcare
• Announcement date: April 8, 2026

Healthcare provider NeoDerm listed by gunra ransomware group

The Hong Kong-based healthcare organization NeoDerm has been listed on the leak site of the ransomware group known as gunra. The threat actor made the announcement on April 8, 2026, claiming to have compromised the institution's data and subsequently making various file structures public.

Details of the claimed attack

According to the announcement posted by the gunra group, the organization's data has been targeted. The threat actor provided a screenshot as evidence, which displays various file directories and database backups that allegedly belong to the systems of NeoDerm. This type of public listing is a common tactic used by ransomware groups to pressure victims.

The group claims to have successfully accessed the organization's internal data. While the specific details regarding the total volume of data or the exact nature of the intrusion remain unconfirmed, the group has proceeded to make the directory structures visible to the public to demonstrate the scope of their alleged access.

Data types identified in the leak

Based on the file names visible in the screenshot provided by the threat actor, several types of sensitive information appear to be involved in the claim. The visible directories and files suggest that the breach may include the following:

• Human resources data: Indicated by the presence of HR-CARD records.
• Database backups: Including specific databases such as INBODY-DB, CTT-HRIS-DB, and HK-TABLEAU-DB-1.
• Development environment files: Specifically pointing to SQL17-DEV.

About NeoDerm

NeoDerm is a chain of aesthetic and dermatology clinics operating in Hong Kong. The organization provides a variety of medical aesthetic services, including skincare and laser treatments, to its clientele.

Analysis and potential implications

This leak claim may pose a significant risk of exposing sensitive healthcare and employee information within NeoDerm. The exposure of database backups is particularly concerning, as such information could potentially be leveraged by malicious actors for identity theft or targeted phishing campaigns. In many jurisdictions, including under Hong Kong's data protection regulations, an organization facing such a situation may be required to issue a formal data breach notification to the affected parties and relevant authorities.

The tactics used by gunra in this instance are often considered part of a double-extortion strategy. In a double-extortion scenario, ransomware actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with its public release. This increases the leverage the attackers hold over the target.

Because information regarding the gunra group is limited, it is difficult to determine the full extent of their operations. However, for organizations in the healthcare sector, such incidents highlight the necessity of robust security measures. It may be necessary for an organization to conduct thorough investigations into its systems to check for potential secondary breaches or the presence of persistent threats that could allow attackers to maintain access to the network.