Fiocruz Listed by noescape Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out research and public-health institutions, treating the sensitive data those organisations hold as leverage. In mid-August 2023 one such listing appeared on a leak site operated by the group known as noescape, naming Brazil’s Oswaldo Cruz Foundation, or Fiocruz, and specifically referencing its Bio-Manguinhos unit. Public detail remains limited; what is known is that the group claimed to have exfiltrated internal files during a ransomware attack. For an institution central to vaccine production and immunobiological research, even an unverified claim carries weight for staff, partners and the wider public-health system.

The incident was reported on 18 August 2023. No confirmed figure for the number of people affected has been released, and the precise contents of the files have not been independently verified. The following account stays strictly within those bounds.

What happened

On or around 18 August 2023 the ransomware group noescape listed Fiocruz on its leak site. The listing asserted that internal files had been exfiltrated in the course of a ransomware attack. The reported summary associated with the listing identified the Institute of Technology in Immunobiology (Bio-Manguinhos), the technical-scientific unit of Fiocruz responsible for producing and developing immunobiological solutions for public-health needs. Beyond that claim, timing of the intrusion, the method of initial access, the volume of data taken and any ransom demand remain undisclosed. No independent confirmation that the files were in fact stolen or published has been supplied in the available record. The number of individuals potentially affected is unknown.

Who is noescape?

noescape is a ransomware operation that emerged in the public eye in 2023 and followed the familiar double-extortion model: encrypting systems while also claiming to steal data and threatening to release it if payment is not made. The group operated a leak site on which it posted victim names and, in some cases, sample files. Like other ransomware crews of that period, it targeted organisations across multiple sectors and geographies, using the publicity of a listing to increase pressure. Claims made on such sites are assertions by the attackers; they are not automatically verified. In this instance the only public statement tied to Fiocruz is the group’s own listing that internal files had been exfiltrated. No further statements attributed to noescape about this specific victim appear in the record.

Fiocruz and its sector

The Oswaldo Cruz Foundation is Brazil’s leading public biomedical-research institution, linked to the Ministry of Health. It conducts research, surveillance and production of vaccines, diagnostics and other immunobiological products. Bio-Manguinhos is the unit charged with manufacturing and developing those products to meet national public-health demand. Organisations of this type routinely handle research data, manufacturing records, supply-chain information, staff and collaborator details, and sometimes clinical or epidemiological material. A breach affecting such an entity raises concerns not only for the confidentiality of internal work but also for the continuity of vaccine and biologics supply and for trust in the public-health infrastructure that depends on it.

The information in question

The sole description provided is that internal files were allegedly exfiltrated in a ransomware attack. No inventory of file types, no count of records and no confirmation of personal data, research datasets or manufacturing documents have been released. Institutions engaged in immunobiological production typically hold proprietary process information, quality-control records, contractual and administrative files, and personal data of employees and research partners. Whether any of those categories were among the material claimed by noescape is unconfirmed. Until more detail is published by Fiocruz or by independent investigators, the exact contents remain unknown.

Why it matters

For individuals whose information may have been present in internal systems—employees, contractors, research collaborators—the practical risks include possible misuse of contact or identity details and targeted phishing that exploits knowledge of their association with Fiocruz. For the organisation itself, the exposure of internal files can complicate ongoing research, manufacturing schedules and relationships with health authorities and suppliers. Even when the scale is unconfirmed, a public listing by a ransomware group can erode confidence and divert resources toward incident response and verification. Because Bio-Manguinhos supports national immunisation programmes, any prolonged disruption or loss of proprietary process data could have secondary effects on public-health readiness, though no such disruption has been documented in the available facts.

Were you affected?

If you work or have worked with Fiocruz or Bio-Manguinhos, or if you have shared personal or professional data with the foundation, treat the listing as a prompt to review your own exposure. Change passwords on related accounts, enable multi-factor authentication where available, and watch for unexpected messages that reference the institution. Because the number of people affected and the precise data types remain unknown, there is no public notification list to consult. You can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets; that step provides one concrete way to assess whether your information has surfaced elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.