Santa Casa de Assis listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: Brazil
• Sector: Healthcare
• Announcement date: December 24, 2025

Santa Casa de Assis targeted by thegentlemen

The healthcare institution Santa Casa de Assis has been listed on the leak site of the threat actor group known as thegentlemen. According to the announcement made by the group, the institution's data has been exfiltrated. This claim was posted on December 24, 2025, with the group alleging that the attack occurred on the same date.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to threaten its public release. By listing a victim on a dedicated leak site, the threat actors aim to damage the organization's reputation and force compliance with ransom demands. However, in this specific instance, the evidence provided by the group is inconclusive due to technical issues on their platform.

Details of the alleged incident

The threat actor group thegentlemen officially listed Santa Casa de Assis on their leak site on December 24, 2025. While the group claims that data belonging to the institution has been exfiltrated, there is currently no detailed evidence regarding the nature of the alleged leak. This lack of clarity is due to the fact that the screenshot provided by the group displays a verification error.

Regarding the specific information involved in this incident, the listing names no data types. No information has been provided regarding the nature of the leaked or compromised data, and the screenshot shows only a technical error message on the group's leak site. Consequently, details such as the total volume of data or the specific number of files involved remain unknown.

About Santa Casa de Assis

Santa Casa de Assis is a long-standing private healthcare institution located in the state of São Paulo, Brazil. Founded in 1919, the institution operates a comprehensive hospital complex. The facility provides a wide range of medical services, including emergency care, surgery, maternity, and intensive care units.

Potential risks and industry implications

Public information about the group known as thegentlemen is limited. Because the target is a healthcare institution, this claim may pose significant risks, such as the exposure of patient privacy and sensitive medical records. In the healthcare sector, the integrity and confidentiality of data are paramount to patient safety and institutional trust.

Under Brazil's LGPD regulations, the institution may face data breach notification requirements, which could lead to administrative sanctions. Furthermore, there is a possibility that the allegedly leaked data could be utilized in identity theft or targeted phishing attacks. Such incidents can have negative impacts on the institution's operational continuity and the trust patients place in the facility.

Organizations in the healthcare sector often implement defensive measures to mitigate these risks. These typically include robust access controls, continuous monitoring of network traffic, and regular security awareness training for staff to prevent phishing. Maintaining up-to-date backups and implementing strict data encryption protocols are also common practices used to protect sensitive medical information from unauthorized access and exfiltration.