Bwizer Listed by trigona Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 16, 2024, the Portuguese healthcare and wellness education platform Bwizer was listed by the ransomware group known as trigona. Public reporting indicates that internal files were exfiltrated as part of a ransomware attack, though the number of people affected remains unknown and many operational details have not been disclosed.

The listing itself is a claim by the group rather than an independently confirmed disclosure. For an organisation that trains healthcare and wellness professionals, any exposure of internal material raises practical questions about the security of institutional data and the potential knock-on effects for people connected to its programmes.

What happened

According to the available public record, Bwizer appeared on a trigona-associated listing dated March 16, 2024. The report states that internal files were exfiltrated during a ransomware attack. No further technical specifics—such as the initial access method, the precise timeline of the intrusion, the volume of data taken, or whether encryption of systems also occurred—have been made public. The number of individuals whose information may have been involved is listed as unknown. At this stage the incident is known primarily through the group’s claim of a listing rather than through detailed confirmation from the organisation or independent investigators.

The group behind it: trigona

Trigona is a ransomware operation that has been active in public reporting since roughly mid-2022. Like many contemporary groups, it has typically followed a double-extortion model: encrypting systems while also stealing data and threatening to publish or sell it if a ransom is not paid. The group has historically listed victims on dedicated leak sites and has targeted organisations across multiple sectors and countries. Its tooling and tactics have evolved over time, but public analyses generally describe a focus on opportunistic intrusion followed by data theft and pressure campaigns. In the present case, the only specific claim tied to Bwizer is the listing itself; no additional statements attributed to trigona about this particular victim have been detailed in the available facts.

Who is Bwizer?

Bwizer is a Portuguese organisation that provides educational resources, courses, workshops and training programmes aimed at professionals in the healthcare and wellness sectors. It positions itself as a bridge between traditional education and the practical, evolving needs of modern healthcare practice. Organisations of this type commonly hold records related to course participants, instructors, institutional partners, internal administrative files, and materials used in professional development. Because the platform serves people working in health-related fields, a breach can affect not only the organisation’s own operations but also the wider community of practitioners who rely on its programmes.

The information in question

The public facts state only that internal files were exfiltrated. No inventory of specific data categories—such as names, contact details, financial records, medical or training histories, or proprietary course materials—has been released. Organisations that deliver professional healthcare and wellness education typically maintain databases of enrolled students and alumni, instructor credentials, payment or enrolment information, and internal operational documents. Whether any of those categories were among the files taken remains unconfirmed. Readers should treat the precise contents as undisclosed until further verified information appears.

The real-world impact

For individuals whose data may have been among the internal files, the practical risks include possible misuse of personal or professional contact details, targeted phishing that references legitimate training relationships, or identity-related fraud if identity documents or financial information were present. Because the exact contents are unknown, the severity for any single person cannot yet be measured. For Bwizer itself, the incident creates operational, reputational and potential regulatory consequences common to ransomware events: disruption of services, costs associated with investigation and recovery, and the need to notify affected parties if personal data is later confirmed to have been involved. Until more detail emerges, both the organisation and any potentially affected people are left with limited visibility into the true scope.

What to do if you're exposed

If you have a past or current relationship with Bwizer—as a student, instructor, partner or employee—treat the situation as a possible exposure until clearer information is available. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever possible, and be cautious of unsolicited messages that reference training programmes or internal systems. Consider changing passwords associated with any accounts that may have been linked to the organisation. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets; such checks provide an additional early-warning signal even when the full contents of a specific incident remain unconfirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.