Ransomcortex ransomware group lists www.donaanita.com on its leak site

• Ransomware group: Ransomcortex
• Country: Brazil
• Sector: Hospitality
• Announcement date: July 12, 2024

Ransomcortex claims data breach at Policlínica Dona Anita

The threat actor known as Ransomcortex has listed www.donaanita.com on its leak site, claiming to possess 30GB of data belonging to the medical clinic. This announcement, which appeared on July 12, 2024, marks a significant potential compromise for the healthcare provider located in Brazil.

Details of the alleged attack

On July 12, 2024, the Ransomcortex group listed www.donaanita.com on its leak site. The threat actor alleges that 30GB of data has been compromised. To support these claims, the post includes several sample file names as evidence. While the group has made these claims public, information regarding this group remains limited in the public domain.

Ransomware leak sites are frequently used by cybercriminals to apply pressure on organizations. In many modern ransomware campaigns, actors employ a strategy known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive data. By threatening to release this stolen information on a public leak site, the attackers aim to coerce the victim into paying a ransom to prevent the disclosure of private information.

Data and affected information

Based on the sample file names provided in the post, such as GUIA_SADT and ASO files, it appears that documents related to medical services and employee records are included. The specific nature of the files suggests a broad scope of sensitive information. The listing identifies the following categories of affected data:

• Patient medical records
• Employee health and occupational records

The presence of such sensitive information in a leak scenario highlights the critical nature of data security in the healthcare industry. When medical and occupational records are involved, the privacy of both patients and staff is directly at risk.

Organization profile

Policlínica Dona Anita is a medical center that has been serving in Cacoal, Brazil, since 2010. As a reference point in the region, the clinic provides healthcare services across various medical specialties.

Risk assessment and industry implications

The alleged compromise of data within the healthcare sector may pose significant risks to patient privacy and data protection. The exposed information may facilitate identity theft or targeted phishing attacks against patients and staff. Furthermore, given the sensitivity of medical data, the institution may experience reputational damage and potential secondary extortion attempts.

From a regulatory standpoint, the organization could face legal consequences under Brazil's LGPD (General Data Protection Law). Laws like the LGPD are designed to protect personal data and impose strict requirements on how organizations handle and secure sensitive information. Failure to protect such data can lead to significant legal and financial liabilities.

To defend against such threats, organizations in the healthcare sector often implement various defensive steps. These include maintaining robust backup solutions, implementing multi-factor authentication, and conducting regular security awareness training for staff. Additionally, continuous monitoring of network traffic and strict access controls can help mitigate the risk of unauthorized data exfiltration. As threat actors continue to target sensitive sectors, maintaining a proactive security posture remains essential for protecting both institutional integrity and individual privacy.