An extortion crew says it has published the medical claims of an Ecuadorian health insurer's clients, more than 400,000 of them, complete with diagnosis codes. In the same week Qilin, one of the busiest ransomware operations on the leak sites, added two of South America's better-known names: the Peruvian beauty company Belcorp and Argentina's Grupo Crónica media group. All three are claims the criminals posted themselves. None has been independently verified, and none of the three organizations had publicly confirmed an incident when we checked.
The listings come from two unrelated crews and were first recorded between October 18 and October 24, 2026, by the independent tracker ransomware.live. Ecuador already featured on the leak sites earlier this month, when two crews claimed the country's National Police.
An insurer's claims file, line by line
The most detailed post is N0n's listing for Asisken Asistencia Médica S.A., a prepaid medical plan provider that its own website places in Ecuador. N0n's post, recorded on October 24 (tracker entry), describes the company as a health insurance administrator in Guayaquil and claims to hold:
- identity and contact records for 139,006 named insurance clients, including identity document numbers and dates of birth;
- 383,159 policy beneficiary records with insured amounts;
- 402,988 medical and insurance claims with diagnosis codes and dollar amounts, current through October 20, 2026;
- policy billing data, home and work addresses and bank account details.
The post is marked "not paid, exposed", the crew's way of saying the files are already out. If the claim is genuine, it is the kind of leak that outlives any password reset: a diagnosis cannot be changed. The tracker files this entry under Argentina, but the post itself places the company in Guayaquil.
N0n is a young operation. WatchGuard's tracker entry classifies it as a data broker rather than a file-encrypting ransomware crew, and ransomware.live's group page now counts 156 claimed victims in 34 countries since its first posts in mid-September. Earlier this month it listed 38 port and shipping firms in one sweep.
Qilin names a beauty brand and a newsroom
Qilin posted Belcorp, the Peru-founded maker of the Ésika, L'Bel and Cyzone beauty brands, on October 18 (tracker entry). The listing carries no description of stolen data. The tracker's page does show infostealer data from Hudson Rock for Belcorp's domain: 326 compromised employees, 508 compromised users and 234 third-party employee credentials. That is a measure of exposure, not evidence of how Qilin got in, or that it got in at all.
A day later Qilin listed Grupo Crónica (tracker entry), whose own site describes an Argentine media group that includes the Crónica HD news channel and the Crónica and BAE Negocios newspapers. Again the post says nothing about what was taken. Qilin's earlier claims are collected on our Qilin profile.
Hunt the weeks before, and plan for patient notices
- Belcorp, Grupo Crónica and their suppliers should look for unusual outbound transfers, new administrator accounts and unfamiliar remote access tools in the weeks before each listing.
- Reset any credentials that infostealer monitoring reports as exposed, including contractors' accounts.
- Ecuadorian insurers and clinics that exchange claims data with Asisken should watch for phishing that quotes real policy or claim details.
- Report confirmed or suspected compromise to the national teams: EcuCERT in Ecuador, CNSD in Peru and CERT.ar in Argentina.
Leak-site posts are sometimes exaggerated, recycled or simply false, and any of these may prove to be one of those. But a claims file that names diagnoses is a different order of harm from a list of company invoices, and Asisken's clients are the people with the least ability to do anything about it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.