Centre Hospitalier Régional de Namur Listed by noescape Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a hospital appears on a ransomware group's listing, the immediate concern is not abstract cybersecurity jargon but the personal information that may now sit outside the institution's control. For patients, staff and partners of Centre Hospitalier Régional de Namur, that possibility raises practical questions about medical records, contact details and other sensitive material that hospitals routinely handle.

Public reporting on 14 June 2023 stated that the Belgian hospital had been listed by the noescape ransomware group, which claimed to have exfiltrated internal files. The number of people affected remains unknown, and many operational details have not been disclosed. What follows summarises only what has been reported and places it in clear context for anyone who may be concerned.

What happened

On 14 June 2023 it was reported that Centre Hospitalier Régional de Namur had been listed by the noescape ransomware group. According to the available summary, the group claimed that internal files had been exfiltrated in a ransomware attack. No confirmed figure for the number of individuals affected has been published, and public detail does not describe the precise method of intrusion, the date the incident began, or whether systems were encrypted, taken offline, or both. The listing itself constitutes a claim by the group rather than an independently verified confirmation of every asserted detail.

Beyond the statement that internal files were taken, the public record available for this incident does not itemise further technical indicators or provide a full timeline. In short, the core known facts are the organisation's appearance on the group's listing, the reported date of that disclosure, and the description of exfiltrated internal files; everything else remains undisclosed or unconfirmed at the time of reporting.

Who is noescape?

noescape was a ransomware operation that came to wider notice in 2023. Like many contemporaneous groups, it followed a double-extortion model: encrypting systems where possible while also copying data and threatening to publish or sell it if a ransom was not paid. The group typically advertised victims on a dedicated leak site, using those listings both to apply pressure and to signal to other potential targets. Public reporting associated noescape with a ransomware-as-a-service style of activity, in which affiliates conducted intrusions and shared proceeds with the core operators.

The group’s public communications and leak-site posts form the basis of many victim attributions; those posts are claims until corroborated by the affected organisation or by independent investigation. noescape’s known activity tapered later in 2023 amid broader law-enforcement and industry pressure on several ransomware brands. Nothing in the public facts for this specific case goes beyond the group’s listing of Centre Hospitalier Régional de Namur and the assertion that internal files had been exfiltrated.

Centre Hospitalier Régional de Namur and its sector

Centre Hospitalier Régional de Namur is a hospital and health-care organisation based in Namur, in the Wallonia region of Belgium. Public business descriptions place it in the 1,001–2,000 employee range with estimated revenue between $100 million and $250 million. As a regional hospital it provides clinical care, diagnostic services and related administrative functions to the local population and surrounding communities.

Hospitals occupy a high-sensitivity position in any data-protection landscape. They necessarily process medical histories, treatment records, identity and contact information, insurance or billing data, and employment records for clinical and support staff. A breach affecting such an institution is consequential because the data involved is often long-lived, difficult to change, and capable of enabling identity misuse, privacy harm or targeted social engineering long after the initial incident. The sector also faces continuous operational pressure: clinical continuity and patient safety remain paramount even while digital systems are under stress.

The information in question

The reported facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file categories, record counts or specific data fields has been disclosed in the material available for this incident. It is therefore not possible to confirm precisely which patient, staff or administrative datasets, if any, were included.

Organisations of this type typically hold electronic health records, appointment and referral information, laboratory and imaging results, billing and insurance details, staff human-resources files, and internal operational documents. Whether any or all of those categories were among the files claimed by noescape remains unconfirmed. Readers should treat the exposure of any particular data type as unverified unless the hospital or competent authorities later publish a clearer inventory.

What's at stake

For individuals, the principal risks are misuse of personal or medical information, unwanted contact, phishing or social-engineering attempts that reference real details, and longer-term privacy exposure. Medical data cannot be “reset” like a password; once outside controlled systems it can retain value for criminals or cause lasting distress if published. Staff whose employment or contact details appear in internal files face similar identity and phishing risks.

For the hospital, stakes include potential regulatory scrutiny under European data-protection rules, the cost and complexity of investigation and remediation, possible disruption to clinical or administrative workflows, and erosion of patient and partner trust. Even when core care delivery continues, the organisation must still determine scope, notify appropriate parties where required, and harden systems against recurrence. Because the number of people affected is unknown and the exact contents of the files remain undisclosed, the full scale of these impacts cannot yet be quantified from public sources alone.

What to do if you're exposed

If you have been a patient, employee or partner of Centre Hospitalier Régional de Namur and are concerned, begin by treating unsolicited messages that reference the hospital or your medical history with caution; verify any request for personal data through official channels you already trust. Monitor financial and insurance statements for unfamiliar activity, and consider placing fraud alerts or credit freezes where local services allow. If the hospital issues official guidance or notification letters, follow the instructions they provide, including any offer of credit monitoring or dedicated support contacts.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step does not confirm or rule out involvement in this specific incident, but it can help you decide whether wider password changes and heightened vigilance are warranted. Keep records of any suspicious contact and report clear evidence of misuse to the relevant national authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.