OSSEG Obra Social del Seguro Listed by vicesociety Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 28, 2022, OSSEG Obra Social del Seguro appeared on a leak site operated by the vicesociety ransomware group. The listing stated that internal files had been taken during a ransomware incident, though the number of individuals affected and any confirmation that data was released remain undisclosed. The group presented the listing as evidence of stolen material, without further public detail on the volume or contents of the files.

What happened

OSSEG Obra Social del Seguro was added to the vicesociety ransomware leak site on March 28, 2022. The entry indicated that internal files had been exfiltrated during a ransomware attack.

No information has been released on the scale of the operation, the method of initial access, or whether any data was subsequently published. The number of people affected is not known.

Who is vicesociety?

Vicesociety is a ransomware operation that maintains a public leak site to list victims from whom it claims to have obtained data. The group follows a pattern seen in several ransomware crews: it combines file encryption with the threat of data disclosure if demands are not met.

Public records show the group has targeted organisations across multiple sectors and countries, posting sample files or directory listings to pressure victims. Specific claims made about any single victim, including OSSEG, originate from the group itself and are not independently verified in available reporting.

About OSSEG Obra Social del Seguro

OSSEG is an Argentine obra social, a form of social-security health coverage tied to a particular industry—in this case, the insurance sector. Such organisations collect and store personal identifiers, employment records, and health-related information for their members and dependents.

Because these entities manage ongoing medical and administrative data for large groups of workers, any confirmed exposure of their systems can affect individuals over an extended period.

What was likely exposed

The vicesociety listing referred to “internal files” taken in a ransomware attack. No inventory of file types, record counts, or specific data categories has been made public.

Organisations of this type routinely hold names, national identification numbers, contact details, employment history, and health-insurance information. The exact contents of the exfiltrated material, if any, have not been confirmed.

Why it matters

Health and employment records can be used for identity-related fraud or targeted scams over many years. When an organisation that administers ongoing benefits is involved, affected individuals may face repeated misuse of their information rather than a single incident.

For the organisation, the incident adds operational costs for investigation, notification where required, and potential regulatory scrutiny under Argentine data-protection rules.

If your data was in this claimed breach

Monitor bank and insurance statements for unusual activity and consider placing fraud alerts with credit bureaus if national ID numbers were involved. Change passwords for any associated online accounts and enable multi-factor authentication where available.

Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in public listings from incidents such as this one.

AICompiled with AI assistance from public sources and published under our editorial standards.