ASP BasilicataASM MateraIRCCS CROB Listed by rhysida Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and public-sector organisations across Europe, using data theft and public leak-site postings as leverage. In this landscape, listings of Italian health authorities appear with some regularity, raising practical questions for patients, staff and partners about what may have been taken and what steps follow.

On 15 February 2024, the ransomware group known as rhysida listed ASP BasilicataASM MateraIRCCS CROB on its leak site, claiming that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail beyond the listing itself is limited. The claim matters because the organisation operates in a sector that routinely holds sensitive personal and medical information.

What happened

Public reporting states that ASP BasilicataASM MateraIRCCS CROB was listed by the rhysida ransomware group on 15 February 2024. The group claims that internal files were exfiltrated during a ransomware attack. No further Reported Details have been released about the precise timing of any intrusion, the scale of any data removal, the technical method used, or whether systems were encrypted. The number of individuals potentially affected is unknown. Available information consists essentially of the leak-site listing and the characterisation of the material as internal files taken in a ransomware incident.

Inside rhysida

Rhysida is a ransomware operation that became publicly visible in 2023. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems where possible while also stealing data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group has previously claimed attacks against healthcare providers, educational institutions and public bodies in multiple countries. Its leak site serves as both a pressure mechanism and a venue for advertising purported victims. In this case, the listing of ASP BasilicataASM MateraIRCCS CROB should be treated as an unverified claim by the group; independent confirmation of the full scope of any compromise has not been provided in the available facts.

ASP BasilicataASM MateraIRCCS CROB and its sector

ASP BasilicataASM MateraIRCCS CROB refers to linked public health entities in the Basilicata region of Italy. These include local health authorities (Aziende Sanitarie) serving Matera and the wider region, together with IRCCS CROB, a scientific institute for hospitalisation and care that functions as a regional oncology reference centre. Organisations of this type deliver clinical care, manage patient pathways, conduct research and handle administrative functions for large populations. They routinely process medical records, diagnostic results, treatment histories, staff records and operational documents. A breach affecting such an entity is consequential because the data involved is often highly personal, regulated under European and Italian privacy rules, and capable of causing lasting harm if misused. Public detail on the precise relationship among the named components in this incident remains limited to the combined listing.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No more specific data categories—such as patient identifiers, clinical notes, financial records or employee information—have been publicly named or confirmed. Organisations of this kind typically hold electronic health records, appointment and billing data, research materials, human-resources files and internal correspondence. Whether any of those categories were among the files claimed by rhysida is unconfirmed. Readers should therefore treat the exact contents of any stolen material as unknown at present.

What's at stake

For individuals whose information may have been involved, the primary risks include identity misuse, targeted phishing that references genuine medical or personal details, and longer-term privacy exposure. Medical data can be particularly sensitive because it is difficult to change and may affect insurance, employment or personal relationships if disclosed. For the organisation, the stakes include potential regulatory scrutiny under data-protection law, operational disruption if systems were encrypted, reputational damage, and the cost of investigation and remediation. Because the number of people affected is unknown and the precise data types remain undisclosed, the full extent of these risks cannot yet be quantified. The incident nonetheless underscores the continuing pressure on healthcare providers to protect both clinical continuity and the confidentiality of the records they hold.

Were you affected?

If you have been a patient, employee or partner of ASP Basilicata, ASM Matera or IRCCS CROB, treat the possibility of exposure seriously even though the scale remains unconfirmed. Monitor financial and medical accounts for unusual activity, be cautious of unsolicited messages that appear to reference your care or employment, and consider placing fraud alerts with relevant credit or identity services where available. Change passwords on any accounts that may have reused credentials linked to the organisation, and enable multi-factor authentication wherever possible. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official notifications, if any are issued by the organisation or Italian authorities, should be followed carefully; until then, the practical steps above remain the most direct way to reduce personal risk.

AICompiled with AI assistance from public sources and published under our editorial standards.