CentroMed Listed by karakurt Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Healthcare and community-service providers remain frequent targets in the current ransomware landscape, where attackers seek both operational disruption and sensitive personal records that can be monetised. Against that backdrop, CentroMed was publicly listed by the karakurt ransomware group on 30 April 2024, with the group claiming to have exfiltrated internal files.

Public reporting indicates that the organisation lost 25 GB of data containing several thousand Social Security numbers together with medical, health, accounting, financial and human-resources information. The number of people affected has not been disclosed, yet the nature of the material makes the incident consequential for patients, staff and the organisation itself.

Breaking down the breach

According to the available record, CentroMed—formerly known as El Centro del Barrio—was listed by the karakurt ransomware group on 30 April 2024. The listing asserts that internal files were exfiltrated during a ransomware attack and that 25 GB of data were taken. That volume is reported to include several thousand Social Security numbers, other medical and health information, and accounting, financial and human-resources data.

No public confirmation of the precise intrusion method, the exact date of initial access, or the total number of individuals whose records were involved has been released. The facts state only that the data were lost in the course of the attack and that the group subsequently listed the organisation on its leak site. Whether the files were later published or used for further extortion remains unconfirmed in the public record.

The group behind it: karakurt

Karakurt is a well-documented ransomware and data-extortion group that has operated since at least 2021. Public reporting characterises the group as focusing primarily on data theft and subsequent extortion rather than on encrypting systems for ransom alone. Its typical pattern involves gaining access, exfiltrating large volumes of files, and then listing the victim on a dedicated leak site while demanding payment to prevent public release.

The group has previously claimed responsibility for incidents involving healthcare, professional-services and mid-sized commercial organisations. In the present case the listing of CentroMed constitutes a claim by the group; independent verification that the files were in fact obtained or that they match the stated contents has not been supplied in the facts provided. Karakurt’s communications and leak-site posts are therefore treated as assertions rather than established fact.

Who is CentroMed?

CentroMed traces its origins to El Centro del Barrio, founded in 1971. The organisation began operating under the CentroMed name in 2001. Early activity centred on a single counselling programme for children and adolescents; over subsequent decades it developed into a community health provider serving primarily underserved populations.

Entities of this type routinely maintain electronic health records, patient demographic data, insurance and billing information, and internal administrative files covering finance, accounting and human resources. Because the organisation handles protected health information and personally identifiable data for vulnerable clients, any unauthorised access carries elevated privacy and regulatory implications under frameworks such as HIPAA.

The information in question

The facts state that the exfiltrated material consists of internal files totalling 25 GB. Within that volume the record specifically notes several thousand Social Security numbers, other medical and health information, and accounting, financial and human-resources data. Exact file names, the full range of data elements, or the precise number of unique individuals represented have not been disclosed beyond these descriptions.

Organisations providing counselling and community health services typically hold clinical notes, treatment histories, insurance identifiers, contact details and employment records. While such categories align with the types of data named in the breach summary, the precise contents of the 25 GB set remain unconfirmed outside the group’s claim and the summarised public report.

The real-world impact

For individuals whose records may be among the files, the primary risks are identity theft, medical-identity fraud and targeted social-engineering attempts that exploit knowledge of health conditions or financial circumstances. Social Security numbers combined with medical details can be used to open fraudulent accounts, file false insurance claims or craft highly personalised phishing messages.

For CentroMed the consequences include potential regulatory scrutiny, notification obligations, remediation costs and erosion of patient trust. Because the organisation serves children, adolescents and other vulnerable populations, the sensitivity of the data heightens both the privacy harm and the reputational stakes. No public figure for financial loss or confirmed patient notifications has been released.

Were you affected?

If you have been a patient, client or employee of CentroMed or its predecessor El Centro del Barrio, consider the following practical steps:

• Monitor credit reports and financial accounts for unfamiliar activity and place fraud alerts if warranted.
• Review Explanation-of-Benefits statements and medical bills for services you did not receive.
• Be alert to unsolicited contacts that reference personal or medical details; verify any such contact through official channels.
• Change passwords on any accounts that may have shared credentials with systems used at the organisation.
• Run a free exposure scan of your email address to check whether it has appeared in known breach data sets.

Public detail on the exact scope of this incident remains limited; continued monitoring of official statements from CentroMed and relevant regulators is advisable.

AICompiled with AI assistance from public sources and published under our editorial standards.