Sindicato de Enfermería (SATSE) listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Spain
• Sector: Healthcare
• Announcement date: February 14, 2024

The Hunters ransomware group has listed the Spanish healthcare organization Sindicato de Enfermería (SATSE) on its dedicated leak site. In an announcement published on February 14, 2024, the threat actors claimed to have targeted the organization, asserting that they successfully conducted both data exfiltration and encryption activities within the victim's systems.

Details of the claimed attack

According to the announcement made by the Hunters group through their own leak platform, the attack is claimed to have taken place on February 13, 2024. The threat actors stated that their operations against Sindicato de Enfermería (SATSE) involved a multi-stage approach common in modern ransomware campaigns. This typically involves the unauthorized extraction of sensitive information from the network followed by the encryption of critical files to disrupt operations.

In such double extortion schemes, attackers leverage the stolen data as additional leverage. By threatening to release sensitive information publicly, the group aims to pressure the victim into meeting ransom demands. While the specific methods used to gain initial access were not detailed in the leak site post, the group's claim of simultaneous exfiltration and encryption suggests a sophisticated intrusion into the organization's digital infrastructure.

Data exfiltration claims

The Hunters group provided specific metrics regarding the volume of information they claim to have stolen from the organization. Based on the information provided in the leak site announcement, the following details were shared:

• Total volume of exfiltrated data: 179 GB
• Total number of files involved: 195,086 files

Regarding the specific nature of the stolen information, the announcement did not provide a detailed breakdown of the content. There is no information available concerning whether the files contain personal identification, financial records, or internal administrative documents. The listing names no specific data types beyond the file count and total size.

About Sindicato de Enfermería (SATSE)

Sindicato de Enfermería (SATSE) is the largest trade union organization representing nursing professionals in Spain. The organization's primary mission is to improve working conditions for nurses, defend their professional rights, and work toward raising standards within the Spanish healthcare system.

Impact and potential risks

The actions attributed to the Hunters International group pose significant risks to the organization. Such an attack can severely disrupt the operational continuity of the union, making it difficult to fulfill its mission of supporting nursing professionals. Furthermore, the exposure of sensitive data can lead to serious consequences for the organization's members and employees.

Because Sindicato de Enfermería (SATSE) operates within Spain, the leaked data may be subject to the General Data Protection Regulation (GDPR). This regulatory framework imposes strict requirements on the protection of personal data, and any breach involving sensitive information could potentially result in legal sanctions. Additionally, the organization and its members may face secondary risks, such as identity theft or targeted phishing attacks, as stolen information is often used in subsequent social engineering campaigns.

It is worth noting that Hunters International is known to utilize the Hive ransomware codebase. While the group has reportedly announced the cessation of its encryption activities as of 2025, this recent action against SATSE may indicate a shift in the group's strategic approach. For organizations in the healthcare and labor sectors, maintaining robust defensive measures—such as regular backups, network segmentation, and comprehensive employee training—remains a critical component of a modern cybersecurity posture to mitigate the impact of such targeted threats.