davila.cl Listed by lockbit5 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 18, 2025, the ransomware group lockbit5 listed davila.cl on its leak site and stated that internal files had been taken from the organization. No figure has been released for the number of people whose information may be involved, and the organization has not confirmed the incident or provided further details. The listing marks the first public indication that davila.cl experienced a ransomware intrusion resulting in data removal. At this stage, the scale of the operation, the method of initial access, and the volume of material taken remain undisclosed.

Breaking down the breach

The only confirmed detail is the December 18 listing itself. The group claims internal files were exfiltrated, yet no timeline for the intrusion, no description of the encryption process, and no statement on whether data was published or offered for sale have been made public. Without additional disclosures from either the group or the organization, the operational facts of the incident stay limited to that single claim.

The group behind it: lockbit5

Lockbit5 is a ransomware operation that has conducted numerous intrusions since its emergence. The group typically gains access through compromised credentials or unpatched systems, deploys encryption across networks, and removes copies of files before demanding payment. Its public leak sites are used to pressure victims by threatening to release stolen material. The same approach has been documented in earlier incidents involving other organizations; the current listing of davila.cl follows that established pattern but has not been independently verified beyond the group’s own statement.

davila.cl and its sector

Davila.cl operates as Red Dávila, a private healthcare network in Chile that provides medical services to patients. Organizations in this sector routinely maintain records that include personal identifiers, clinical histories, appointment details, and administrative information required for treatment and billing. A breach affecting such an entity can therefore touch individuals who have received care, as well as employees whose employment and payroll data are stored in the same systems.

The information in question

The listing refers only to “internal files.” No inventory of specific data categories has been released. Healthcare providers of this type commonly store medical records, identification numbers, contact information, insurance details, and internal correspondence. Until davila.cl or an official investigation publishes a confirmed list, the precise contents of the exfiltrated material cannot be stated as fact.

Why it matters

For individuals whose records may be among the files, the primary concern is the potential misuse of health-related information, which can affect insurance eligibility, employment, or personal privacy over an extended period. For the organization, the incident adds operational costs for investigation, possible regulatory reporting, and restoration of systems. Both outcomes remain conditional on details that have not yet been confirmed.

Were you affected?

Individuals can begin by contacting davila.cl directly to ask whether their information was involved and what steps the organization is taking. Monitoring financial and medical accounts for unusual activity provides a practical next measure. Readers may also run a free exposure scan of their email address against known breach data to check for prior appearances in other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.