Shifa Oman listed on thegentlemen ransomware leak site

• Ransomware group: thegentlemen
• Country: Oman
• Sector: Healthcare
• Announcement date: September 9, 2025

Shifa Oman listed on thegentlemen leak site

The threat actor known as thegentlemen has listed Shifa Hospital, a healthcare provider based in Oman, on their dedicated leak site. This announcement, which was discovered on September 9, 2025, involves claims made by the group regarding the institution's data security. The group asserts that they have successfully obtained data belonging to the organization.

Details of the alleged attack

According to the information provided by the threat actor, the alleged attack occurred on July 21, 2025. The listing appeared on the group's platform, marking a significant development in the ongoing threat landscape facing the organization. While the group has made claims regarding the institution, the specific nature of the breach remains tied to the group's assertions on their leak site.

Regarding the specifics of the incident, no details regarding the nature of the leaked data have been provided. The available evidence, such as screenshots, only displays the general interface of the group's leak site rather than specific file contents or documentation. Furthermore, there is no information available regarding the total size of the data, the specific count of files involved, or any ransom demands made by the group.

Organization profile

Shifa Hospital is a multispecialty private healthcare facility located in Muscat, Oman. The facility is designed to provide services that meet international standards and was established by Omani pioneers. The institution is dedicated to providing comprehensive medical services to meet the healthcare needs of the country.

Analysis and potential impact

This incident suggests that sensitive data belonging to a healthcare institution may have been compromised. The potential exposure of medical records could lead to privacy violations and secondary risks such as identity theft. If double extortion tactics are employed, it may create significant pressure on the institution's operational continuity. Double extortion is a common ransomware tactic where attackers not only encrypt data to disrupt operations but also steal sensitive information to threaten the victim with public disclosure unless a ransom is paid.

The group thegentlemen has limited public information available, meaning a definitive assessment of their specific methods and motivations cannot be made at this time. Organizations in the healthcare sector often face significant legal obligations under data protection regulations when such incidents occur. To mitigate such risks, organizations typically focus on robust defensive measures, including regular security audits, employee training to prevent phishing, and maintaining offline backups to ensure operational resilience.

Summary of the incident

• Organization: Shifa Oman
• Threat Actor: thegentlemen
• Claimed Attack Date: 2025-07-21
• Discovery Date: 2025-09-09
• Type of Incident: Data leak claim