Hospital Sírio-Libanês, the São Paulo institution that the tracker's record describes as one of Brazil's largest private hospital groups, has been named on the leak site of an extortion crew calling itself THE SEVEN DEADLY SINS. The independent tracker ransomware.live first recorded the post on 16 October, in a record tied to the hospital's domain, hsl.org.br, and flags it with a warning of its own: this is an emerging group, so the claim should be treated with caution until independently verified.
We found no public confirmation of an incident from the hospital at the time of writing. The post shows no sample of stolen data, and no one outside the crew has said what, if anything, was taken.
Two more health providers in the same ten days
Sírio-Libanês was not the only Brazilian health provider named in the past ten days. On the same morning, 16 October, The Gentlemen listed CLIMEDI, a private clinic and diagnostic centre in Aracaju, Sergipe, which the tracker estimates was hit on 14 October (tracker record). The record describes a nuclear medicine service that includes PET-CT scanning and thyroid cancer therapy, and says the clinic works with SUS, Brazil's public health system, as well as private insurers.
On 8 October NightSpire named INI Fiocruz, the Instituto Nacional de Infectologia Evandro Chagas, the infectious disease hospital and research unit of the federal Oswaldo Cruz Foundation in Rio de Janeiro (tracker record). The tracker puts the estimated attack date at 7 July, three months before the listing appeared. That estimate is the tracker's, not a confirmed date.
A busy month for Brazil gets busier
The three health claims sit inside a wider climb. Our incident tracking holds 30 leak-site claims against Brazilian organisations so far in October, one more than it recorded in the whole of September. That follows the record month we reported in our look at Brazil's busiest month on the leak sites, and the run of South American public bodies and hospitals we covered in early September. No single crew drives it: eight different groups named Brazilian victims in the last seven days alone.
Stolen logins are a separate warning sign
The tracker's page for Sírio-Libanês also carries infostealer figures supplied by Hudson Rock, which catalogues credentials harvested by password-stealing malware. It counts 188 compromised employees and 2,066 compromised users associated with the hospital's domain. Those numbers do not show that the crew got in, or how. They do show a pool of exposed logins that any attacker could try, and they are the kind of exposure a hospital can act on without waiting for the crew's next move.
Reset exposed credentials, and treat the claims as live
The three organisations, and the clinics, insurers and suppliers that connect to them, should reset any credentials known to have been exposed, enforce multi-factor authentication on remote access, and watch for phishing that borrows their names or references real appointments and invoices. Patients should be wary of unexpected calls or messages that cite their medical details. Under Brazil's data protection law, the LGPD, a controller must notify the national authority, ANPD, and the people affected of a security incident that could cause them relevant risk or damage. National context is on our Brazil country page, and CERT.br coordinates incident response.
Every listing here is a statement written by criminals, and some such statements turn out to be recycled, inflated or simply false. But hospitals hold the data that extortion crews can lean on hardest, and three providers named in ten days is a pattern Brazil's health sector should not wait to see confirmed.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.