Instituto Nacional de Oftalmologia, Peru Listed by nightspire Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and public medical institutions worldwide, treating patient-facing organisations as high-value pressure points because of the sensitivity of the records they hold and the operational disruption that can follow an attack. In this climate, listings on criminal leak sites have become a routine way for threat actors to advertise claimed compromises and attempt to force payment.

On 9 November 2025 the Instituto Nacional de Oftalmologia in Peru appeared on a listing associated with the nightspire ransomware group. Public detail remains limited: the number of people affected is unknown, and the only description of the material involved is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group and has not been independently confirmed in the available record.

Inside the incident

According to the reported information, Instituto Nacional de Oftalmologia, Peru was listed by the nightspire ransomware group on 9 November 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No further technical particulars—such as the initial access method, the precise date of intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public summary. The number of individuals whose information may have been involved is listed as unknown. Beyond the group’s claim that internal files were removed, no additional confirmation of the scope or success of the attack has been provided in the available facts.

Inside nightspire

Nightspire is a ransomware operation that follows the now-common double-extortion model: encrypting systems while also stealing data and threatening to publish it if payment is not made. Groups of this type typically advertise victims on dedicated leak sites, posting sample files or full archives to increase pressure. Public reporting on nightspire has described it as one of several actors that emerged or became more visible in the mid-2020s, focusing on organisations whose data or operational continuity carries high leverage. The group’s listing of Instituto Nacional de Oftalmologia is presented as a claim that the organisation was compromised and that internal files were taken; no independent verification of that specific claim appears in the facts provided here.

About Instituto Nacional de Oftalmologia, Peru

The Instituto Nacional de Oftalmologia is Peru’s national ophthalmology institute, a specialised public medical centre focused on eye care, diagnosis, treatment and related research. Institutions of this kind routinely manage large volumes of clinical records, appointment systems, diagnostic images, laboratory results and administrative files that identify patients, staff and partners. Because eye-care services often involve long-term follow-up and specialised procedures, the organisation holds data that is both medically sensitive and personally identifiable. A ransomware incident affecting such a body raises concerns not only about confidentiality but also about continuity of care for patients who depend on its services.

What data was at risk

The available facts state only that “internal files” were exfiltrated in a ransomware attack. No inventory of specific data categories—such as patient names, medical histories, contact details, financial records or staff information—has been published. Organisations of this type typically store clinical notes, imaging studies, identity documents, insurance or billing data, and internal administrative correspondence. Until a fuller disclosure or independent analysis appears, the exact contents of the claimed exfiltration remain unconfirmed. Readers should treat any assertion about particular data types as speculative unless corroborated by official statements.

Why it matters

For individuals, the exposure of medical or administrative files can create lasting risks of identity misuse, targeted phishing, or embarrassment if sensitive health details surface. Even when the precise data set is unknown, the mere possibility that clinical or personal records left the organisation’s control is enough to warrant caution. For the institute itself, a ransomware event can interrupt clinical operations, erode public trust, and trigger regulatory or contractual obligations to notify affected parties and strengthen controls. Because the number of people potentially affected is listed as unknown, the full scale of any downstream harm cannot yet be measured.

If your data was in this claimed breach

If you have been a patient, employee or partner of Instituto Nacional de Oftalmologia, monitor financial and medical accounts for unexpected activity and treat unsolicited messages that reference the institute with extra scrutiny. Consider placing fraud alerts with credit bureaus where available and review privacy settings on any related online portals. Because the exact data involved has not been confirmed, a free exposure scan of your email address against known breach corpora can provide an early indication of whether your details have already appeared in public dumps. Stay alert for official notifications from the organisation or Peruvian authorities rather than relying solely on third-party claims.

AICompiled with AI assistance from public sources and published under our editorial standards.