Cooperativa de Hospitales de Antioquia - COHAN Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On April 20, 2026, the ransomware group qilin listed Cooperativa de Hospitales de Antioquia - COHAN on its leak site and claimed to have stolen internal files from the organization. The number of individuals whose information may be involved is not known, and no further details about the scale or method of the incident have been made public. The listing raises immediate questions for patients, staff, and partners of the cooperative about how their records might be handled if the claimed data reaches wider circulation.

Breaking down the breach

The only confirmed public record of the incident is the April 20, 2026 listing on qilin’s leak site. The group states that internal files were taken during a ransomware operation. No information has been released on the date of the intrusion itself, the volume of data involved, or whether any files were subsequently published. The organization has not issued a statement confirming or disputing the claim.

Inside qilin

Qilin is a ransomware-as-a-service operation that has been active since at least 2022. The group typically gains initial access through compromised credentials or unpatched systems, deploys encryption across targeted networks, and then exfiltrates data before demanding payment. Its public listings are part of a double-extortion approach in which the threat actors threaten to release stolen material if ransom demands are not met. The group has previously claimed activity against organizations in multiple countries and sectors, though each listing remains an assertion by the actors themselves until independently verified.

Cooperativa de Hospitales de Antioquia - COHAN and its sector

Cooperativa de Hospitales de Antioquia - COHAN is a cooperative that supports a network of hospitals and clinics in the Antioquia region of Colombia. Entities of this type coordinate clinical services, administrative functions, and patient record management across member facilities. Healthcare cooperatives routinely process medical histories, treatment details, insurance information, and staff records. Disruptions or unauthorized disclosures in this sector can affect continuity of care and the confidentiality of sensitive personal information.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data categories has been published. Organizations that manage hospital cooperatives commonly store patient identifiers, clinical notes, laboratory results, billing records, and employee documentation. The precise contents of any material allegedly taken from COHAN remain unconfirmed.

What's at stake

Individuals connected to the cooperative face the possibility that personal or medical details could be used for targeted fraud, phishing, or unauthorized access to other accounts if the files circulate. The organization itself may encounter operational strain from any required investigation, regulatory notifications, or restoration of systems. Because the number of records involved is undisclosed, the full scope of these consequences cannot yet be measured.

Were you affected?

Anyone who receives services or works with Cooperativa de Hospitales de Antioquia - COHAN should watch for direct communications from the organization about the incident. Practical steps include reviewing account statements for unusual activity, enabling multi-factor authentication on any linked services, and requesting a copy of personal records held by the cooperative to verify their accuracy. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

• Monitor official statements from COHAN for updates on any confirmed exposure.
• Request a copy of your medical or administrative records from the cooperative to review for accuracy.
• Enable multi-factor authentication on accounts that may share identifiers with the affected systems.
• Consider a credit or identity monitoring service if financial or identification details are routinely held by the organization.

AICompiled with AI assistance from public sources and published under our editorial standards.