ThreeAM ransomware group lists coosalud.com on its leak site

• Ransomware group: ThreeAM
• Country: Colombia
• Sector: Healthcare
• Announcement date: September 28, 2026

ThreeAM claims Coosalud in new leak site listing

The threat actor known as ThreeAM has listed the Colombian entity coosalud.com on its dedicated leak site. This announcement, observed on September 28, 2026, marks a new development in the activities of the group. While the listing confirms that the organization has been targeted, the specific details surrounding the incident remain limited due to the nature of the announcement.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. In many modern cyberattacks, known as double extortion, attackers not only encrypt an organization's data but also threaten to publish sensitive information on public forums if their demands are not met. This tactic is designed to maximize leverage by threatening the victim's reputation and legal standing. In this specific case, the threat actor has made a public claim regarding the compromise of the organization, though the group itself remains relatively obscure, with limited public information available regarding its specific methods or history.

Details of the claimed event

The announcement made by ThreeAM includes general information regarding the operations of coosalud.com. However, the listing is currently lacking in several key areas of detail. Specifically, the announcement does not provide any information regarding the total size of the data allegedly stolen, nor does it specify the total count of files involved in the breach. Furthermore, the threat actor has not issued a specific ransom demand as part of this public listing.

The timing of the announcement suggests that the incident may still be unfolding. Because no concrete data samples or specific file types have been released by the group, it is possible that the situation is currently in a negotiation phase between the attackers and the target. In such scenarios, threat actors often use the threat of a leak to initiate contact with the victim's management or technical teams.

Data involved in the listing

The current listing names no data types or specific file categories that have been allegedly compromised.

About Coosalud

Coosalud is a major health promotion entity (EPS) operating in Colombia. The organization plays a critical role in the Colombian healthcare system by managing both subsidized and contributory healthcare regimes. As a significant part of the country's healthcare infrastructure, it provides essential healthcare access to millions of members across the region.

Potential implications and industry context

Given the organization's prominent presence in the healthcare sector, a potential data breach poses significant risks. The healthcare industry is a frequent target for cybercriminals due to the high value of the sensitive information they manage. A successful breach in this sector can lead to severe consequences for patient privacy and the protection of personal information. If sensitive data is indeed leaked, it could result in secondary risks for the affected individuals, such as identity theft and the execution of targeted phishing attacks.

Beyond the immediate privacy concerns, the organization could face significant legal repercussions under local Colombian data protection regulations. Regulatory bodies often impose strict requirements on healthcare providers to ensure the confidentiality and integrity of patient records. Failure to protect this data can lead to investigations and legal penalties.

To defend against such threats, organizations in the healthcare sector typically implement various defensive measures. These include robust encryption for data at rest and in transit, multi-factor authentication (MFA) for all remote access points, and continuous monitoring of network traffic to detect anomalous behavior. Additionally, maintaining regular, offline backups and conducting frequent incident response drills are essential components of a modern cybersecurity posture. As the digital landscape evolves, the reliance on these defensive layers becomes increasingly vital for maintaining public trust and ensuring the continuity of essential services.