Inversiones Clinica Del Meta SA Listed by medusalocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Healthcare organisations remain frequent targets in the current ransomware landscape, where operators combine encryption with data theft and public listing to pressure victims. Against that backdrop, Inversiones Clinica Del Meta SA was named on 28 February 2025 by the medusalocker ransomware group, which claims to have exfiltrated internal files from the organisation.

Public reporting so far is limited to the group’s own leak-site listing. The number of people affected is unknown, and independent confirmation of the intrusion has not been released. Even so, any claim involving a medical provider raises immediate questions about the possible exposure of sensitive personal and clinical information.

Breaking down the breach

According to the listing dated 28 February 2025, medusalocker claims to have conducted a ransomware attack against Inversiones Clinica Del Meta SA and to have removed internal files. The group’s post associates the victim with the domain www.clinicameta.co and states that the material includes employee information, patient information, agreements, password data and appointment information. It further asserts that the files are being offered for sale with one-day access at a price of $100 000, with options for buyers to profit from the data included in the deal.

No technical details of the initial access method, the encryption event, or the volume of data taken have been published by the organisation or by independent researchers. The scale of the incident—how many individuals or records may be involved—remains undisclosed. The listing itself constitutes an unverified claim by the threat actor.

Who is medusalocker?

Medusalocker is a ransomware operation that has been active for several years and is known for double-extortion tactics. Operators typically encrypt systems while simultaneously exfiltrating data, then threaten to publish or sell the stolen material if a ransom is not paid. The group maintains a dedicated leak site where it posts victim names, sample files and sale notices. Past campaigns have targeted organisations across multiple sectors, including healthcare, manufacturing and professional services. Public reporting on medusalocker consistently describes a business model that monetises both the ransom demand and the subsequent sale of stolen data. Claims made on its leak site about any specific victim, including Inversiones Clinica Del Meta SA, should be treated as assertions by the group rather than independently Reported Facts.

Who is Inversiones Clinica Del Meta SA?

Inversiones Clinica Del Meta SA is a healthcare-related organisation operating in Colombia, associated with clinical services under the clinicameta.co domain. Entities of this type typically manage hospitals or clinics and therefore hold large volumes of patient records, employee data, contractual agreements and operational schedules. A breach at such an organisation is consequential because medical providers are custodians of highly sensitive personal information—identities, medical histories, contact details and financial or insurance data—whose unauthorised disclosure can affect patients, staff and business partners for years.

What data was at risk

The medusalocker listing names the following categories as having been exfiltrated: employee information, patient information, agreements, password data and appointment information. These are the only data types explicitly claimed by the group. No further inventory, file counts or sample contents have been independently confirmed. Organisations in the clinical sector commonly store additional material such as medical histories, diagnostic results, billing records and insurance details; whether any of those were among the files taken remains unconfirmed. Public detail on the precise contents is therefore limited to the categories asserted by the threat actor.

The real-world impact

If the claimed data are authentic, individuals whose records appear in the files face risks of identity misuse, targeted phishing, medical fraud or social-engineering attacks that exploit knowledge of appointments or personal circumstances. Employees could see credentials or personal details used against them. The organisation itself may confront operational disruption, regulatory scrutiny under data-protection rules, and the longer-term cost of notifying affected parties and strengthening controls. Because the number of people involved is unknown and the sale notice remains unverified, the full extent of harm cannot yet be measured. The mere public listing, however, already creates uncertainty for patients and staff who must assume their information could be circulating.

Were you affected?

Anyone who has been a patient, employee or contractor of Inversiones Clinica Del Meta SA should treat the claim seriously until more information emerges. Practical first steps include:

• Monitor financial and medical accounts for unexpected activity.
• Change passwords that may have been reused across services, especially any linked to the clinic’s systems.
• Enable multi-factor authentication wherever available.
• Watch for phishing messages that reference appointments, medical history or employment details.
• Request a free exposure scan of your email address to check whether it has already appeared in known breach datasets.

If you receive formal notification from the organisation, follow the guidance it provides. Until independent confirmation or official statements appear, treat the medusalocker listing as an unverified claim and act on the side of caution.

AICompiled with AI assistance from public sources and published under our editorial standards.