RansomHub ransomware group lists osmedica.com.ar on its leak site

• Ransomware group: RansomHub
• Country: Argentina
• Sector: Healthcare
• Announcement date: November 27, 2024

RansomHub claims to have compromised Osmédica data

The RansomHub ransomware group has published a notice on its dedicated leak site claiming to have stolen data belonging to the Argentina-based healthcare organization osmedica.com.ar. This announcement, made on November 27, 2024, suggests a significant breach involving the sensitive information of a major medical service provider.

According to the claims made by the threat actor, the group successfully compromised the organization's systems and subsequently released a large number of documents. These documents reportedly contain a wide array of administrative and medical records belonging to the entity. The group's post indicates that the breach occurred around the same time the announcement was made, on November 27, 2024.

Details of the claimed data leak

The information allegedly released by RansomHub includes a variety of sensitive files that could impact both patients and medical staff. The leaked content is described as containing critical documentation that spans medical, administrative, and personal identification categories. Specifically, the group claims to have shared the following types of data:

• Patient medical records
• Personal identification information
• Financial invoice data
• Physician and staff information

The specific content of these files reportedly includes patient names, DNI (national identity) numbers, medical diagnoses, surgical protocols, physician information, invoices, and health insurance records. No specific information was provided regarding the total size of the data breach or the exact number of files involved. Furthermore, no ransom demand has been disclosed in the public announcement.

About Osmédica

Osmédica is an Argentine healthcare and health insurance organization. The entity provides various health plans and medical services to individuals and families within the country, serving as a significant provider of medical coverage and healthcare services.

Impact and security assessment

The exposure of such sensitive information poses a high risk of identity theft and fraud for the individuals whose data has been compromised. Because the leak includes personal identification numbers and medical diagnoses, the exposure of this medical data could lead to direct violations of patient privacy rights and may create negative impacts on institutional trust. It is likely that the organization will face legal sanctions under data protection regulations in Argentina due to the nature of the exposed information.

Given the past activities of the RansomHub group, it is assessed that the leaked data could be used for secondary attacks or targeted phishing campaigns. Ransomware groups often employ a double extortion tactic, where they not only encrypt an organization's data to demand a ransom but also threaten to leak the stolen information on public sites to increase pressure. Even though it has been reported that the RansomHub group ceased its operations in early 2025, it is anticipated that the leaked data may continue to pose a persistent risk to the affected parties.

Organizations operating in the healthcare sector face unique challenges in protecting such vast amounts of sensitive data. To mitigate these risks, it is generally recommended that healthcare entities implement robust access controls, maintain rigorous encryption standards for data at rest and in transit, and conduct regular security audits. Furthermore, continuous monitoring of network traffic and the implementation of multi-factor authentication are essential defensive steps to prevent unauthorized access to medical and administrative databases.