Famisanar Listed by pysa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 9, 2021, Famisanar appeared on the leak site maintained by the Pysa ransomware group. The listing indicated that internal files had been taken during a ransomware operation. The number of individuals whose information may be involved remains unknown, and no further details about the scope or contents of the material have been made public. This development places Famisanar among organizations whose data-handling practices have drawn the attention of ransomware operators. For people whose records are held by the organization, the incident raises questions about the security of personal and administrative information that such entities routinely process.

What happened

Famisanar was listed on the Pysa ransomware leak site on September 9, 2021. The group claims to have stolen internal data during a ransomware attack. No confirmation of the listing or additional technical details have been released by the organization. The number of people affected is not publicly reported, and the method of initial access or encryption remains undisclosed.

Who is pysa?

Pysa, also tracked as Mespinoza, is a ransomware group that emerged around 2019 and has conducted operations against organizations in multiple countries. The group typically employs a double-extortion approach: encrypting systems and copying files, then threatening to publish the copied material if a ransom demand is not met. Listings on its leak site serve as a public signal that data has been taken, whether or not the files are later released. Pysa has appeared in connection with incidents across healthcare, education, and government sectors, though each claim must be evaluated separately.

Famisanar and its sector

Famisanar operates in Colombia’s healthcare system as an Entidad Promotora de Salud, or health insurance and service provider. Organizations of this type maintain large volumes of administrative and medical records to coordinate care, process claims, and comply with regulatory requirements. A breach at such an entity can expose both routine business documents and information that individuals submit when seeking medical services or coverage.

What data was at risk

The only detail released is that internal files were allegedly exfiltrated. The precise categories of information contained in those files have not been disclosed. Healthcare and insurance organizations commonly store patient identifiers, clinical notes, insurance details, and correspondence; however, whether any of these categories were present in the material claimed by Pysa is unconfirmed.

Why it matters

Even without a confirmed count of affected individuals, the exposure of internal files from a healthcare provider can create downstream risks. Personal identifiers combined with medical or insurance information may be used for identity-related fraud or targeted scams. For the organization, the incident adds operational and regulatory pressure at a time when healthcare entities already manage strict data-protection obligations.

What to do if you're exposed

Individuals who receive services through Famisanar or similar providers can take several practical steps while waiting for official notices.

• Monitor bank and insurance statements for unusual activity.
• Enable multi-factor authentication on any patient portals or insurance accounts.
• Request a copy of your records from the provider to understand what information is held.
• Run a free exposure scan of your email address against known breach data to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.