moscati.org Listed by krybit Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

What is known is limited. On July 1, 2026, the ransomware group krybit listed moscati.org on its leak site and stated that internal files had been taken from Hôpital Catholique Saint Joseph Moscati. No figure for the number of individuals affected has been released, and the hospital has not confirmed the incident or the extent of any data removal. The practical consequence for patients, staff and other individuals connected to the hospital is that personal or administrative records may now exist outside the organisation’s control. Until more information is published, the scope of that exposure remains unclear.

Breaking down the breach

The only confirmed detail is the group’s listing itself. krybit claims to have carried out a ransomware operation against moscati.org and to have exfiltrated internal files. No date of the alleged intrusion, no volume of data, and no list of specific file types have been made public. The number of people whose information may be involved is also undisclosed.

The group behind it: krybit

krybit is a ransomware operation that maintains a public leak site where it lists organisations it claims to have compromised. Like other groups of this type, it typically seeks payment in exchange for not publishing stolen material. Its listings are presented by the group as evidence of successful access; independent confirmation of each claim is not always available at the time of publication.

Who is moscati.org?

moscati.org operates as Hôpital Catholique Saint Joseph Moscati, a Catholic hospital. Hospitals routinely process patient medical records, admission details, laboratory results, billing information and staff employment data. A breach at any healthcare provider is consequential because the records involved are often detailed and difficult to change.

What was likely exposed

The listing states that internal files were exfiltrated. No further breakdown of file categories or data fields has been released. Organisations of this type commonly hold patient identifiers, clinical notes, insurance details and administrative correspondence, but the precise contents of the material claimed by krybit remain unconfirmed.

The real-world impact

Individuals whose records appear in the exfiltrated material could face risks of identity misuse or unwanted disclosure of sensitive health information. The hospital may incur costs related to investigation, notification and remediation. At present there is no public indication of how the organisation has responded or whether it has notified regulators or affected people.

Were you affected?

If you have been a patient or employee of the hospital, monitor official statements from moscati.org and any communications sent by the organisation. You can also check whether your email address appears in known breach data sets through a free exposure scan.

• Change passwords for any accounts linked to the hospital.
• Enable multi-factor authentication on patient portals or staff systems.
• Review bank and insurance statements for unusual activity.
• Consider a credit freeze if financial identifiers were involved.

AICompiled with AI assistance from public sources and published under our editorial standards.