Hospital El Cruce Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Healthcare providers remain frequent targets in the ransomware landscape, where attackers seek both operational disruption and leverage from sensitive records. Against that backdrop, Hospital El Cruce of Argentina was listed on 19 January 2025 by the medusa ransomware group, which claims to have exfiltrated internal files totaling 761.60 GB.

Public detail is limited: the number of people affected is unknown, and the precise contents of the files have not been independently confirmed. Even so, any confirmed or claimed compromise of a hospital’s internal systems raises immediate questions for patients, staff and the wider community about privacy, continuity of care and secondary fraud risks.

Breaking down the breach

According to the available record, Hospital El Cruce was listed by the medusa ransomware group on 19 January 2025. The listing asserts that internal files were exfiltrated during a ransomware attack and that the total volume of data involved is 761.60 GB. No further technical details—such as the initial access vector, the date the intrusion began, whether encryption was deployed on production systems, or any ransom demand—have been disclosed in the public facts. The number of individuals whose information may be involved is likewise unknown. The incident is therefore known primarily through the group’s leak-site claim rather than through independent forensic confirmation released by the hospital or regulators.

The group behind it: medusa

Medusa is a ransomware operation that has been active in recent years and is publicly documented as employing a double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to pressure victims. The group maintains a leak site on which it posts victim names, sample files and, in some cases, full archives when negotiations stall. Public reporting has associated medusa with attacks across multiple sectors, including healthcare, manufacturing and government-adjacent entities. Typical tactics include exploitation of exposed remote-access services, phishing, and the use of commodity tools for lateral movement and data staging. In this case the group claims Hospital El Cruce as a victim and asserts the 761.60 GB figure; those assertions remain unverified claims unless corroborated by the organisation or independent investigators.

About Hospital El Cruce

Hospital El Cruce is a medical facility located at 5401 Av. Calchaqui, Florencio Varela, Buenos Aires, 1888, Argentina. Publicly available description indicates it operates with 130 beds and provides a broad range of services that include advanced diagnostic testing and highly specialised surgical procedures. The organisation is reported to employ approximately 116 people. As a hospital it sits within the critical healthcare sector, where systems routinely process clinical records, imaging, laboratory results, administrative data and staff information. A ransomware incident affecting such an institution can interrupt care delivery, delay procedures and create lasting privacy concerns for anyone whose data resides in the compromised environment.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack and that the claimed volume is 761.60 GB. No specific data categories—such as patient names, medical histories, financial details or employee records—have been named or independently verified. Organisations of this type typically hold electronic health records, diagnostic images, appointment and billing information, staff personnel files and operational documents. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of those categories, if any, were included in the claimed 761.60 GB. Readers should treat any assertion of particular data types as speculative until official disclosure occurs.

Why it matters

For individuals, the principal risks are identity theft, medical-identity fraud and targeted phishing that leverages knowledge of real appointments or diagnoses. Even limited administrative data can be combined with other breaches to build convincing social-engineering attacks. For the hospital, consequences may include temporary disruption of clinical workflows, costs associated with system recovery and notification, potential regulatory scrutiny under Argentine data-protection rules, and erosion of patient trust. Because the scale of personal impact is unknown, both patients and staff who have interacted with the facility have reason to monitor for unusual activity without assuming the worst.

What to do if you're exposed

If you have been a patient, visitor or employee of Hospital El Cruce, treat the listing as a prompt for caution rather than confirmed personal compromise. Monitor bank and credit statements for unfamiliar activity, enable multi-factor authentication on email and financial accounts, and be sceptical of unsolicited messages that reference medical care or request personal details. Consider placing fraud alerts with credit bureaus where available. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; such a scan provides an additional data point but does not replace official notifications from the hospital itself. If you receive formal notice from Hospital El Cruce or Argentine authorities, follow the guidance it contains and retain copies for your records.

AICompiled with AI assistance from public sources and published under our editorial standards.