Consorci Sanitari Integral Listed by ransomexx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

In October 2022, the Catalan healthcare consortium Consorci Sanitari Integral appeared on a ransomware leak site, with the group behind the listing claiming to hold a substantial volume of the organisation’s internal files. For patients, staff and partners whose information may sit inside those systems, the practical stakes are immediate: healthcare records and administrative data can be used for identity misuse, targeted fraud or unwanted contact long after an incident is first reported. Public detail remains limited, and the number of people affected has not been established.

What is known is that the listing attributed the incident to the ransomexx group and described internal files said to have been taken in a ransomware attack, with a claimed data volume of 52.47GB. No independent confirmation of the full scope or contents has been set out in the available record. Understanding what was claimed, who the actor is, and what steps individuals can take is the clearest way to respond without speculation.

Inside the incident

According to reporting dated 11 October 2022, Consorci Sanitari Integral was listed by the ransomexx ransomware group. The available facts state that internal files were exfiltrated in a ransomware attack and give a leaked data size of 52.47GB. The number of people affected is unknown. Timing of the intrusion itself, the initial access method, whether encryption was deployed alongside theft, and any negotiation or recovery timeline are not disclosed in the public record summarised here.

The listing on a ransomware leak site is a claim by the group. It does not by itself confirm that every file described was authentic, complete or subsequently published in full. Organisations in this position sometimes face pressure from the threat of staged releases; whether further material was posted, and what it contained, is not detailed in the facts provided. Scale beyond the stated 52.47GB figure and precise file categories remain unconfirmed outside that claim.

The group behind it: ransomexx

Ransomexx is a known ransomware operation that has appeared in public reporting for several years. Like other groups in this category, it has typically been associated with double-extortion tactics: encrypting systems where possible while also copying data and threatening to publish or sell it if a ransom is not paid. The group has used leak sites to name victims and, in many cases, to stage samples or larger archives as proof. It has been observed targeting organisations across multiple sectors and regions rather than a single industry niche.

Public technical reporting has linked ransomexx activity to relatively hands-on intrusion work, often after initial access through compromised credentials, exposed remote services or other common enterprise weaknesses, followed by lateral movement and data staging. Exact tooling and affiliates can vary over time. For this incident, the facts support only that Consorci Sanitari Integral was listed and that the group claimed exfiltration of internal files totalling 52.47GB. No victim-specific statements, ransom demands or proof packages beyond that listing detail are included in the provided record, so nothing further should be assumed about what ransomexx asserted in private channels.

Consorci Sanitari Integral and its sector

Consorci Sanitari Integral is a healthcare consortium based in Catalonia, Spain. Entities of this kind coordinate or deliver clinical and support services across hospitals, primary care and related facilities. They sit at the centre of regional care pathways, which means their systems commonly hold clinical documentation, appointment and administrative records, staff information and operational files needed to run multi-site services.

A breach affecting a healthcare consortium is consequential because the same systems that support treatment and continuity of care also concentrate sensitive personal and organisational data. Disruption can affect scheduling, records access and trust in how information is protected. Even when clinical care continues, the secondary risk—misuse of personal details—can persist for those whose data was stored or processed by the organisation. The facts do not establish operational downtime or clinical impact in this case; they establish a claimed data theft event against a healthcare provider in that regional setting.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack, with a claimed volume of 52.47GB. No further breakdown—such as patient records, staff HR files, financial documents or specific database exports—is provided. Exact contents are therefore unconfirmed.

Organisations of this type typically hold a mix of clinical and administrative information: identifiers and contact details, health-related documentation, billing or insurance-related data, workforce records and internal correspondence or operational documents. That is the general profile of the sector, not a verified inventory of what was taken here. Readers should treat any assumption about particular data categories as unproven unless the organisation or a competent authority later confirms them.

The real-world impact

For individuals, the main risks are long-tail rather than theatrical. If personal or health-related information was among the internal files, it could support phishing that appears more credible, attempts at identity fraud, or unwanted disclosure of private matters. Even purely administrative data—names, contact details, appointment references—can be combined with other breaches to build fuller profiles. Because the number of people affected is unknown, it is not possible to say how widely those risks apply.

For the organisation, a claimed exfiltration of this size raises obligations around investigation, notification where required by law, and hardening of systems. Reputation and contractual relationships with partners and patients can be strained while facts are still being established. None of this requires concluding negligence; ransomware groups routinely target complex environments, and the public record here does not assign root cause. The concrete impact depends on what was actually taken, who received it, and how quickly affected parties are informed and supported—details that remain limited in the available summary.

If your data was in this claimed breach

If you are a patient, employee or partner of Consorci Sanitari Integral and believe your information may have been involved, start with basics: treat unexpected messages that reference the organisation or your care with caution; verify any request for personal data or payments through official channels you already trust; and consider monitoring financial and identity accounts for unusual activity. If you receive breach notification from the organisation or a regulator, follow the specific guidance in that notice, including any offer of support services.

Where passwords may have been reused on related accounts, change them and enable multi-factor authentication where available. Keep records of any suspicious contact. For a practical check on whether your email address has already appeared in known breach datasets, you can run a free exposure scan of your email; that will not confirm inclusion in this specific incident, but it can show whether your details have surfaced elsewhere and help you prioritise further protections.

AICompiled with AI assistance from public sources and published under our editorial standards.