Attent Zorg en Behandeling Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and care providers, where operational disruption and sensitive personal data create strong leverage. In early 2023, the Dutch organisation Attent Zorg en Behandeling appeared on a leak site operated by the qilin ransomware group, which claimed to have stolen internal files after unauthorised access. Public detail on the incident remains limited, yet any confirmed exposure of care-related records carries lasting consequences for patients, staff and the organisation itself.

What is known comes chiefly from the group's own listing and from the organisation's public statements about unauthorised access. The number of people affected has not been disclosed, and independent verification of the full scope is not available in the public record. The episode nevertheless illustrates how claims of data theft, even when contested, force care providers and the people they serve to confront concrete privacy and security risks.

What happened

On or around 1 March 2023, Attent Zorg en Behandeling was listed by the qilin ransomware group. According to the group's statement, internal files had been exfiltrated in a ransomware attack. The group further alleged that the organisation had misled customers by claiming that systems were functioning normally and that no serious leaks had occurred, pointing to an update published on the organisation's own website about unauthorised access to IT systems.

No public figure has been given for the volume of data taken, the precise date of initial intrusion, or the technical method used. The number of individuals whose information may have been involved remains unknown. The listing itself constitutes a claim by the threat actor; it has not been independently confirmed in the material available here. Beyond the assertion that internal files were removed, further operational detail is undisclosed.

Who is qilin?

Qilin is a ransomware operation that has been active in the cyber-crime ecosystem for several years, typically functioning as a ransomware-as-a-service model. Affiliates gain access to victim networks, exfiltrate data, and deploy encryption, after which the group pressures organisations by threatening to publish stolen material on a dedicated leak site. This double-extortion approach—combining operational disruption with the threat of data exposure—has become standard among many ransomware crews.

Public reporting on qilin has documented attacks across multiple sectors and countries, with victims often facing both locked systems and the prospect of sensitive files being released. The group commonly posts short statements on its leak site accusing victims of downplaying incidents. In the present case, the only specific claim attributable to qilin is the listing of Attent Zorg en Behandeling and the accompanying assertion that internal files were taken and that the organisation had not been fully transparent. No additional technical indicators or ransom demands unique to this incident are provided in the available facts.

About Attent Zorg en Behandeling

Attent Zorg en Behandeling is a Dutch organisation operating in the care and treatment sector. Entities of this type deliver healthcare, support and related services to clients who may include vulnerable adults or individuals requiring ongoing medical or social care. As a matter of ordinary practice, such organisations maintain records that can encompass medical histories, treatment plans, contact details, insurance or administrative data, and information about staff and partner providers.

A breach affecting a care provider is consequential because the data involved is often highly personal and because continuity of care can be disrupted if systems are encrypted or taken offline. Even when encryption is not confirmed, the mere claim that internal files have left the network raises legitimate concerns for clients, employees and regulators. Public trust in care institutions depends in part on the secure handling of sensitive information; any credible allegation of unauthorised access therefore carries reputational and operational weight beyond the immediate technical incident.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as names, medical records, financial details or employee information—has been publicly itemised in the material provided. The exact contents therefore remain unconfirmed.

Organisations in the care and treatment sector typically hold a range of sensitive material: client identification and contact data, clinical or support notes, appointment and billing records, and internal administrative documents. Whether any or all of these categories were among the files claimed by qilin is not established. Until a fuller accounting is released by the organisation or by independent investigators, it is not possible to state with certainty what personal information, if any, has been exposed.

What's at stake

For individuals whose data may have been involved, the primary risks are misuse of personal or health-related information, targeted phishing or social-engineering attempts that exploit knowledge of their care relationship, and longer-term privacy harm if records circulate beyond the original incident. Because the number of people affected is unknown and the precise data types are undisclosed, the scale of individual exposure cannot be quantified from public sources.

For Attent Zorg en Behandeling the stakes include potential regulatory scrutiny under data-protection rules, the cost of investigation and remediation, possible service disruption, and erosion of confidence among clients and partners. Ransomware incidents also create secondary pressure: even if systems are restored, the threat of publication can linger, and organisations must balance transparency with the need to avoid amplifying unverified claims. None of these consequences imply established negligence; they simply describe the ordinary aftermath when a care provider is named in a ransomware leak listing.

What to do if you're exposed

If you are a client, former client or employee of Attent Zorg en Behandeling, treat the situation as a precautionary matter rather than confirmed personal compromise. Monitor financial and healthcare-related accounts for unexpected activity, be alert to unsolicited contacts that reference your care or personal details, and consider placing fraud alerts where appropriate. Preserve any official notices you receive from the organisation and follow guidance issued by Dutch data-protection or healthcare authorities.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Doing so provides one additional data point; it does not replace official notification or professional advice, but it can help you decide whether further steps—such as password changes or credit monitoring—are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.