Three extortion crews have named South Asian organizations whose data matters to far more people than their own staff: the state police force of Rajasthan in India, a cancer hospital in Bangladesh, and one of Pakistan's largest reproductive health charities. All three are claims the crews posted on their own leak sites, and none has been independently verified.
The listings were first recorded between October 21 and October 24, 2026, by the ransomware.live tracker. They come from three unrelated groups, so this is not one campaign. In IntelFusions' own incident data for the past seven days, the United States accounted for 89 leak-site claims, while India, Bangladesh and Pakistan together accounted for four. Earlier this year we tracked a sharp rise in claims against Indian firms in Ransomware claims against Indian firms tripled in a month.
A police force on a data broker's leak site
Scarlettgroup listed police.rajasthan.gov.in, the web domain of Rajasthan Police, in a post ransomware.live first recorded on October 21, with an estimated attack date of October 14 (tracker entry). The post describes the force as the state's law enforcement agency. It does not say what data was taken or how much, and a listing under a web domain can mean anything from a scraped or compromised public website to a deeper intrusion into internal systems, and the post alone does not settle which. Scarlettgroup is also a newcomer: WatchGuard's ransomware tracker classifies it as a data broker using direct and double extortion alongside free data leaks, first seen in September 2026, with accounts on the BreachForums and PwnForums hacking forums. Its other claims are on our Scarlettgroup profile.
Qilin adds a Bangladeshi cancer hospital
Qilin, one of the most active ransomware operations on the leak sites, posted Labaid Cancer Hospital And Super Speciality Center on October 23 (tracker entry). The listing carries no description of any stolen data.
The tracker's page does show infostealer data from Hudson Rock for the hospital's domain: one compromised employee and four third-party employee credentials. That is a known exposure, not evidence of how Qilin got in, or that it got in at all. This month Qilin also listed a Malaysian state water asset company, covered in Malaysia's water asset firm lands on Qilin's leak site.
Panzer claims 100GB from a reproductive health charity
Panzer listed the Family Planning Association of Pakistan, known as Rahnuma-FPAP, early on October 24, with an estimated attack date of October 23 (tracker entry). The crew claims to have exfiltrated 100GB. Its post describes the organization as one of Pakistan's largest and oldest civil society groups focused on reproductive health, running a network of clinics that offer family planning, HIV/AIDS care, gynecology and obstetrics.
If the claim is genuine, files from a clinic network offering HIV care and reproductive health services could include exactly the records patients most expect to stay private. Panzer first appeared on its Tor leak site in August 2026, and leak-site trackers have recorded at least 17 claimed victims across at least eleven countries. WatchGuard profiles it as an emerging ransomware-as-a-service operation that pairs data theft with encryption. One of its earlier listings was Spain's national weather agency.
Treat each listing as a lead and check the weeks before it
For the named organizations, and for peers in the same sectors across India, Bangladesh and Pakistan:
- Hunt for unusual outbound transfers, new administrator accounts and unfamiliar remote access tools in the weeks before each estimated attack date.
- Reset any credentials that infostealer monitoring reports as exposed, including contractors' accounts.
- Health providers holding HIV and reproductive health records should prepare patient notification plans now, before any files are published.
- Report confirmed or suspected compromise to the national team: CERT-In in India, BGD e-Gov CIRT in Bangladesh and PKCERT in Pakistan.
Leak-site posts are sometimes exaggerated, recycled or simply false, and these three may yet prove to be any of those. But a police force and two health providers in four days, from three separate crews, is a reminder that the extortion economy's long tail reaches well beyond the markets that dominate its headlines.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.