rhp.com.br Listed by lockbit3 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations that hold large volumes of personal and operational data, often by combining encryption with public leak-site postings to force negotiations. In that landscape, the listing of rhp.com.br by the LockBit3 group on 29 August 2024 fits a familiar pattern of claimed data theft from entities that manage patient and internal records.

Public detail remains limited to the group's own assertions. The listing states that internal files were exfiltrated and that the material includes information about more than 70 000 patients, staff, contractors and investors. No independent confirmation of the volume, the precise contents or the method of intrusion has been released, yet the claim alone raises clear questions for anyone whose details may have been held by the organisation.

What happened

On 29 August 2024, the LockBit3 ransomware group added rhp.com.br to its leak site. The entry asserts that internal files were taken during a ransomware attack and that the haul covers information on more than 70 000 patients, staff, contractors and investors. The number of people actually affected is listed as unknown. No technical details of the intrusion, no timeline of when systems were compromised, and no independent verification of the data volume have been made public. The incident is therefore known only through the group's claim and the accompanying summary that internal files were exfiltrated.

Inside lockbit3

LockBit3 is a well-documented ransomware-as-a-service operation that has been active for several years. Affiliates typically gain initial access through phishing, exploited vulnerabilities or stolen credentials, then move laterally, exfiltrate data and encrypt systems. The group maintains a public leak site where it posts victim names and sample files if a ransom is not paid, a tactic known as double extortion. Prior campaigns have targeted healthcare, manufacturing and professional-services organisations across multiple countries. In this case the group claims to hold material from rhp.com.br; that claim has not been independently confirmed beyond the listing itself.

rhp.com.br and its sector

rhp.com.br appears to operate in a sector that routinely handles patient records, staff details and contractual information. Organisations of this type in Brazil commonly store medical histories, contact data, employment files and investor or partner records. A breach involving such material is consequential because the data are both sensitive and long-lived: medical identifiers and personal identifiers can be reused for fraud or social-engineering attacks years after the initial incident. The listing therefore places the organisation and anyone whose information it held under heightened scrutiny, even while the exact scope remains unconfirmed.

What data was at risk

The only named category of exposed material is “internal files exfiltrated in a ransomware attack.” The group’s own summary states that these files contain information about more than 70 000 patients, staff, contractors and investors. No further breakdown—such as specific document types, dates of records or confirmation that the full set was published—has been released. Organisations that manage patient and workforce data typically hold names, contact details, medical or employment identifiers, and contractual or financial notes. Whether any of those elements were present in the claimed files, and in what volume, is unconfirmed.

What's at stake

For individuals, the practical risks include identity misuse, targeted phishing that references real medical or employment details, and long-term privacy exposure. For the organisation, the stakes include regulatory scrutiny, potential notification duties, operational disruption and reputational damage. Because the number of people affected is unknown and the precise contents remain unverified, the full extent of these risks cannot yet be quantified. The listing itself, however, is already public and may be used by other actors to craft more convincing social-engineering attempts.

Were you affected?

If you have been a patient, employee, contractor or investor linked to rhp.com.br, treat the claim as a prompt for caution rather than confirmed compromise. Practical first steps include:

• Monitor financial and medical accounts for unexpected activity.
• Enable multi-factor authentication on email and any portals that hold personal data.
• Be alert to unsolicited messages that reference medical, employment or investment details.
• Request a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Public information about this incident is limited to the LockBit3 listing dated 29 August 2024 and the group’s assertion that internal files covering more than 70 000 individuals were taken. Further official statements, if any, will be needed to clarify the true scope.

AICompiled with AI assistance from public sources and published under our editorial standards.