Institut Mensalus S.L. Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Institut Mensalus S.L., a Spanish multidisciplinary centre specialising in psychology, psychiatry and related therapies, was listed by the 8base ransomware group on 25 July 2023. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical details have not been disclosed.

Because the organisation handles clinical and personal information, any confirmed exposure of internal material carries clear consequences for patients and staff. At present the listing itself is a claim by the group, and independent confirmation of the full scope is limited.

What happened

On 25 July 2023 the ransomware group known as 8base publicly listed Institut Mensalus S.L. on its leak site. The available summary indicates that internal files were taken during a ransomware attack. No figure for the volume of data, no count of affected individuals, and no description of the initial access method or encryption timeline have been released in the public record. Whether a ransom demand was issued or paid is likewise undisclosed. The incident is therefore known chiefly through the group’s own listing and the brief accompanying description of exfiltrated internal files.

Inside 8base

8base is a ransomware operation that became active in public view in 2022–2023. Like many contemporary groups it follows a double-extortion model: data are stolen before systems are encrypted, and the threat of publication is used to pressure victims. The group maintains a dedicated leak site on which it names organisations and, in some cases, releases sample files or larger archives when negotiations stall. Its victims have spanned multiple countries and sectors, typically mid-sized enterprises and professional-service firms rather than the largest global corporations. Public reporting has not established any unique technical signature that would distinguish this particular listing from the group’s broader pattern of activity; the claim that Institut Mensalus S.L. data were taken rests on 8base’s own assertion.

About Institut Mensalus S.L.

Institut Mensalus S.L. describes itself as a multidisciplinary team of more than thirty professionals drawn from psychology, psychiatry, neuropsychology, educational psychology and speech therapy, with more than three decades of experience. Its services centre on assistance and treatment—individually designed therapies, diagnostic assessment, advice and one-off consultations—delivered through coordinated psychiatry and psychology teams. Organisations of this type routinely hold detailed clinical histories, diagnostic notes, contact details, appointment records and billing information. A breach affecting such a centre therefore touches material that is both personally sensitive and subject to strict health-data protections under European law.

The information in question

The only data category named in public reporting is “internal files exfiltrated in a ransomware attack.” No inventory of file types, no confirmation of patient records, staff data or financial documents, and no statement of whether the material has been published have been supplied. Centres providing psychological and psychiatric care typically store clinical notes, treatment plans, identity and contact information, insurance or payment details, and internal administrative correspondence. Until a fuller disclosure or independent verification appears, it is not possible to state which of these categories, if any, were included in the claimed exfiltration.

Why it matters

Even when the precise contents remain unconfirmed, the real-world risks attached to a ransomware incident at a mental-health provider are concrete:

• Patients may face exposure of highly personal clinical information, with potential effects on privacy, employment or personal relationships.
• Staff and contractors could see their own contact or administrative data circulated.
• The organisation itself may confront regulatory scrutiny, notification duties and operational disruption while systems are restored.
• Secondary misuse—phishing, identity fraud or targeted social engineering—becomes more plausible once internal documents leave the organisation’s control.

These harms do not require sensational framing; they follow directly from the nature of the data such a clinic holds and from the established tactics of groups that publish stolen files.

Were you affected?

If you have been a patient, client or employee of Institut Mensalus S.L., treat the possibility of exposure seriously until more information emerges. Monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and be alert to unsolicited messages that reference clinical or personal details. Consider placing fraud alerts with relevant credit or identity services if you believe sensitive identifiers may have been involved. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official updates, if any, should come from the organisation itself or from competent data-protection authorities; until then, public detail remains limited to the 8base listing and the statement that internal files were taken.

AICompiled with AI assistance from public sources and published under our editorial standards.