Centro Médico Especializado OSI Listed by Kazu Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 23, 2026, the ransomware group known as kazu listed Centro Médico Especializado OSI on its leak site. The listing names the Peru-based healthcare provider; it does not, in the material available for this report, establish confirmed theft, publish a verified inventory of files, or show independent corroboration from the organisation or a regulator. As of writing, Centro Médico Especializado OSI has not publicly confirmed the claim.

That distinction matters. Leak-site posts are pressure tactics used in extortion campaigns. They can be accurate, inflated, recycled, or false. Readers should treat what follows as an account of a claim and of the ordinary risks that arise when a medical provider’s name appears in that setting—not as a verified breach report.

What is being claimed

According to the listing, kazu has named Centro Médico Especializado OSI as a target. Public detail attached to that claim is thin. The number of people who might be affected is unknown. Data types supposedly involved are not disclosed in the facts available for this article. Timing of any alleged intrusion, method of access, ransom demand, and whether any files were actually transferred are likewise undisclosed.

What is known is the headline fact of the listing itself and the date it was reported: August 23, 2026. Beyond that, the group’s post functions as an accusation and a threat of publication, not as an audited incident record. No confirmation from the clinic network, Peruvian authorities, or a recognised breach index is part of the material summarised here.

Inside kazu

kazu operates in the familiar ransomware-and-extortion model used by many criminal crews: pressure a named organisation by threatening to publish material the group claims to hold, often on a dedicated leak site. Groups in this category typically blend encryption claims with data-theft claims, use countdown-style postings, and rely on reputational and regulatory fear—especially in healthcare—to force negotiation. Public reporting on such actors generally emphasises that listings are marketing for extortion, not neutral disclosure.

For this specific victim, only the listing claim should be attributed to kazu. There is no basis in the provided facts to repeat alleged file counts, sample documents, or technical narratives the group may use elsewhere. Readers should assume the group’s description of what it holds is unverified until the organisation or an official investigation says otherwise.

Centro Médico Especializado OSI and its sector

Centro Médico Especializado OSI is described as a healthcare provider in Peru focused on physical medicine, rehabilitation, physiotherapy, chiropractic care, and related therapeutic and alternative-medicine services. Founded in 1999 and headquartered in Lima, it is characterised as one of the country’s larger rehabilitation and physiotherapy networks, with multiple clinics in the Lima metropolitan area and a focus on mobility, pain reduction, and quality-of-life care.

Healthcare and rehabilitation providers sit at the intersection of clinical care and sensitive personal information. Even without any confirmed incident, a leak-site claim against such an organisation draws attention because patients reasonably expect medical and administrative records to stay confidential, and because clinics often coordinate appointments, billing, referrals, and ongoing therapy plans that depend on trust and continuity of operations.

What was likely exposed

The facts for this listing do not name exposed data types. Exact contents are unconfirmed. It is not established that any particular category of record left the organisation’s control.

If files from a rehabilitation and physiotherapy network were ever taken, organisations in this sector typically hold some mix of identity and contact details, appointment and scheduling data, clinical notes related to physical medicine and therapy, referral information, billing or insurance-related records, and staff or contractor information. That is a sector-level pattern, not an inventory of this claim. Because the listing does not disclose data types, no specific element should be treated as known to be exposed.

What's at stake

For patients and staff, the practical stakes of a healthcare-related extortion claim—if any personal data were involved—include unwanted contact, phishing that impersonates the clinic, misuse of identity details, and embarrassment or discrimination fears around health information. Rehabilitation and pain-related care can be especially sensitive for individuals who do not want treatment history widely known.

For the organisation, a public leak-site listing can disrupt operations through distraction, patient concern, and the need to investigate and communicate carefully, regardless of whether the underlying claim is fully accurate. Regulatory and contractual expectations around health data in many jurisdictions add pressure to assess and respond even to unproven allegations. None of that proves negligence or confirms loss; it explains why listings against medical providers attract scrutiny.

A leak-site entry alone does not establish what was accessed, whether backups were affected, or how long any alleged activity lasted. Those points remain open without confirmation.

If your data was involved

If you are a patient, former patient, or employee and you worry your information might be implicated, proceed on a conditional basis. Prefer official channels from the clinic for any notice; treat unexpected messages that urge urgent payment, password entry, or personal details as suspicious even if they use the organisation’s name. Consider monitoring financial and identity accounts for unusual activity, and be cautious with emails or calls that reference rehabilitation appointments or bills you do not recognise.

Where appropriate under local law, you may ask the organisation what it can say about the listing and whether it will notify affected people if an incident is later confirmed. Keep records of any suspicious contact. As a general hygiene step, you can also run a free exposure scan of your email address to see whether that address has already appeared in other known breach datasets—bearing in mind that such scans do not prove involvement in this specific claim, only whether your email shows up in previously catalogued leaks.

Until Centro Médico Especializado OSI or a competent authority confirms otherwise, the responsible reading of the August 23, 2026 report is limited: kazu has listed the organisation; scale, method, and data content remain undisclosed; and the incident is not publicly confirmed.

AICompiled with AI assistance from public sources and published under our editorial standards.