Tengu ransomware group lists https://seha.org.sa on its leak site

• Ransomware group: Tengu
• Country: Saudi Arabia
• Sector: Healthcare
• Announcement date: January 14, 2026

Tengu ransomware group claims data breach against seha.org.sa

The threat actor known as Tengu has published a notice on its leak site, claiming that it has obtained data belonging to the Saudi Arabian organization seha.org.sa. This announcement, made on January 14, 2026, suggests that the organization's digital assets may have been subjected to unauthorized access by the group.

Details of the alleged attack

According to the announcement posted by the Tengu group, the organization seha.org.sa was targeted in a cyberattack. To substantiate their claims regarding the breach, the threat actor has shared various images of documents that they purport to have obtained from the organization's internal systems. This tactic is a common feature of modern ransomware operations, where groups attempt to prove the validity of a breach to pressure victims.

The announcement indicates that the breach occurred on the same day it was reported, January 14, 2026. While the group has provided visual evidence to support their allegations, the specific details regarding the scope of the intrusion remain unverified. The presence of these images on a leak site is a hallmark of a data breach event, where the adversary uses stolen information as leverage.

Data involvement and evidence

The threat actor has provided certain visual evidence to support the claim of a successful intrusion. The provided screenshots display numerous document samples that appear to be related to the organization's various operations. However, it is important to note that the specific content of these documents is blurred in the shared images, making it impossible to verify the exact nature of the information contained within them.

• The listing names no specific data types.

At this time, there is no information available regarding the total volume of data stolen or the specific number of files involved in this incident. Furthermore, no ransom demand has been specified in the public announcement.

Organization profile

The target of this alleged attack, seha.org.sa, is a non-profit organization operating within the Qassim region of Saudi Arabia. The entity is dedicated to providing essential health and social services to individuals in need within that region.

Risk assessment and sector implications

This alleged leak carries significant risks, particularly regarding the potential exposure of sensitive information belonging to the individuals served by the organization. Because the entity operates within the healthcare sector, the implications of a data breach are particularly severe. If the leaked data includes personal health information, it could lead to secondary risks for the affected individuals, such as identity theft and various forms of fraud.

Beyond the impact on individuals, such an incident can have broader consequences for the organization itself. A breach of this nature can negatively impact the organization's operational credibility and may trigger complex legal processes under regional data protection regulations. The necessity of maintaining trust is paramount for organizations providing social and health services to vulnerable populations.

The Tengu group remains a relatively obscure entity, and information regarding their specific motivations and technical capabilities is currently limited. Therefore, a definitive assessment of the group's underlying goals or their specific technical methods cannot be made at this time. In general, organizations in the healthcare sector often implement defensive measures such as robust encryption, multi-factor authentication, and continuous monitoring to mitigate the risks posed by such threat actors.