Unimed do Brasil listed on sarcoma leak site

• Ransomware group: sarcoma
• Country: Brazil
• Sector: Healthcare
• Announcement date: October 15, 2025

The threat actor known as sarcoma has listed Unimed do Brasil on its leak site. According to the announcement made on October 15, 2025, the group claims to have compromised a significant amount of data belonging to the organization.

The claimed attack and event details

The sarcoma group has published an announcement on their dedicated leak site claiming responsibility for an attack on Unimed do Brasil. The claim suggests that the breach occurred on October 15, 2025. According to the threat actor, the volume of the compromised data is approximately 2.8 TB.

Ransomware attacks involving leak sites often follow a pattern known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat actors then use the threat of leaking this stolen information on a public website to pressure the victim into paying a ransom. If the ransom is not met, the attackers proceed to release the data to damage the victim's reputation or attract further attention.

Details of the claimed data

The announcement made by sarcoma specifies the nature of the stolen information. The group claims that the leaked data consists of the following:

• Various files
• SQL database contents

While the group has specified the size and general types of the data, it is important to note that no screenshots were provided with the announcement. Consequently, the specific details and the exact contents of the files and databases cannot be verified at this time. No information was provided regarding the specific ransom demand or the total file count.

About Unimed do Brasil

Unimed Pelotas is a healthcare organization based in Pelotas, Brazil, providing a wide range of medical services. The institution offers digital health solutions such as a mobile application for patient tracking, a doctor search guide, and online medical consultations.

Potential impact and industry implications

This incident may result in the exposure of the organization's patient and operational data. The leaked SQL databases could lead to the compromise of personal health information and identification details. Such an event may lead to regulatory consequences under Brazil's LGPD and potential reputational damage for the institution. Secondary risks may include the use of leaked data in identity theft or targeted phishing campaigns.

In the healthcare sector, the sensitivity of the data makes these incidents particularly critical. Medical records, personal identifiers, and financial information are highly valued on the dark web. When such data is leaked, organizations often face a complex recovery process involving legal compliance, forensic investigations, and patient notification protocols.

To defend against such threats, organizations in the healthcare sector typically implement multi-layered security strategies. This includes robust access controls to limit the movement of attackers within a network, comprehensive logging and monitoring to detect unauthorized data exfiltration, and regular offline backups to mitigate the impact of encryption. Furthermore, maintaining strict compliance with regional data protection laws, such as the LGPD in Brazil, helps ensure that organizations have established protocols for handling sensitive information and responding to potential breaches.

Information about the sarcoma group remains limited in the public domain, making it difficult to determine the full scope of their operations or their specific motivations beyond the initial claim of data theft.