AFECC - Hospital Santa Rita de Cássia Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Healthcare organisations remain frequent targets for ransomware groups that combine system encryption with data theft, seeking leverage through the sensitivity of medical records and the operational pressure of patient care. In this landscape, listings on criminal leak sites have become a common way for attackers to claim success and pressure victims, even when independent confirmation is limited.

On 19 June 2025, Hospital Santa Rita de Cássia, also referenced as AFECC, was listed by the incransom ransomware group. Public detail indicates that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and the precise scope of the incident has not been independently verified beyond the group’s claim.

What happened

According to the available record, Hospital Santa Rita de Cássia was listed by the incransom ransomware group on 19 June 2025. The listing asserts that internal files were exfiltrated as part of a ransomware attack. No public confirmation of the attack’s technical method, the volume of data taken, the systems involved, or any ransom demand has been provided in the facts. The number of individuals whose information may have been exposed remains unknown. Timing beyond the reporting date of the listing is undisclosed, as is any statement from the hospital confirming or denying the claim.

In the absence of further disclosure, the incident rests on the group’s assertion that it obtained and removed internal files. Such listings are treated as claims until corroborated by the organisation or independent investigators. No additional details about recovery, containment, or notification to authorities appear in the public summary.

Inside incransom

incransom is a ransomware operation that follows the now-familiar double-extortion model: encrypting systems while also stealing data and threatening to publish it if payment is not made. Groups of this type typically maintain dedicated leak sites where they post victim names, sample files, or countdown timers to increase pressure. Public reporting on incransom and similar actors shows they often target organisations whose data carries high sensitivity or whose downtime carries high cost, including healthcare providers.

Their tactics commonly involve initial access through phishing, compromised credentials, or unpatched remote services, followed by lateral movement, data staging, and encryption. Once data is claimed to be exfiltrated, the group lists the victim and may release portions of the material if negotiations fail. For this specific listing of Hospital Santa Rita de Cássia, the only public assertion is that internal files were taken; no further claims by the group about the hospital’s systems, patient volume, or ransom amount are recorded in the facts. The listing itself should be understood as an unverified claim by the threat actor.

About Hospital Santa Rita de Cássia

Hospital Santa Rita de Cássia is a philanthropic hospital founded in 1970. It is recognised across its state as a reference centre for cancer treatment while also providing general medical specialties. As a philanthropic entity it serves a broad population, aiming to deliver quality care and comfort. Institutions of this kind typically manage large volumes of clinical, administrative, and personal data necessary for diagnosis, treatment, billing, and continuity of care.

A breach involving a cancer-treatment and multi-specialty hospital is consequential because the data such facilities hold can include highly sensitive health information. Patients often share detailed medical histories, contact details, and insurance or payment records. Disruption or exposure at a reference centre can affect not only individual privacy but also trust in the institution’s ability to protect those who rely on it for specialised care.

The information in question

The facts state that internal files were exfiltrated in the ransomware attack. No further breakdown of file types, patient records, employee data, or financial documents is provided. The exact contents therefore remain unconfirmed.

Organisations of this kind typically hold electronic health records, diagnostic imaging and pathology results, appointment and treatment schedules, contact and demographic information, insurance or billing data, and internal administrative documents. Because the public record names only “internal files,” it is not possible to state which of these categories, if any, were among the material claimed by the group. Readers should treat any specific description of exposed data as speculative until official confirmation is issued.

The real-world impact

For individuals, the primary risk is that personal or medical information, if present among the internal files, could be misused for identity fraud, targeted phishing, or unauthorised disclosure of health conditions. Cancer-related records are especially sensitive; their exposure can cause lasting privacy harm even if financial loss does not immediately follow. Because the number of people affected is unknown, the scale of this risk cannot yet be quantified.

For the hospital, a ransomware incident that includes data exfiltration can interrupt clinical workflows, force temporary reliance on paper processes, and require costly recovery and forensic work. Reputational damage and regulatory scrutiny may follow, particularly for a philanthropic reference centre that serves a wide community. Operational continuity and patient confidence are both at stake, independent of whether a ransom is paid.

If your data was in this claimed breach

If you have been a patient, employee, or partner of Hospital Santa Rita de Cássia, treat the listing as a reason for caution rather than confirmed exposure. Monitor financial accounts and credit reports for unusual activity, be alert to phishing messages that reference medical care or the hospital, and consider placing fraud alerts with credit bureaus if you believe your identifiers may have been involved. Request a copy of your medical records or contact the hospital’s privacy office if you wish to understand what data they hold about you and whether they have issued any formal notification.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Such checks do not prove or disprove involvement in this specific incident, but they can help you prioritise further protective steps while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.