Shamir Medical Center Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On October 2, 2025, the ransomware group known as qilin listed Shamir Medical Center on its leak site, claiming it had infiltrated the hospital’s systems and removed a large volume of internal files. Public reporting so far rests on that listing and the group’s own statement; independent confirmation of the intrusion, the exact scope, or the number of people affected has not been released.

Because the target is a major Israeli medical facility, any confirmed compromise of internal records would carry clear consequences for patients, staff, and the wider healthcare system. At present the available facts remain limited to the group’s claim and the basic description of the incident as a ransomware attack involving exfiltration of internal files.

What happened

According to the listing published by qilin, the group asserts that it gained full access to systems at Shamir Medical Center (referred to by the group as Shamir Hospital) and exfiltrated approximately 8 terabytes of sensitive and confidential material. The incident is described as a ransomware attack in which internal files were removed. No public timeline of the intrusion, no technical details of the initial access method, and no confirmed count of affected individuals have been disclosed. The number of people potentially impacted remains unknown, and no independent verification of the group’s claims has been made available in the material provided.

Inside qilin

qilin is a well-documented ransomware-as-a-service operation that has been active for several years. Like many groups in this category, it typically employs double-extortion tactics: encrypting systems while simultaneously stealing data and threatening to publish it if a ransom is not paid. The group maintains a leak site where it posts victim names and sample files to increase pressure. Public reporting has linked qilin to attacks across multiple sectors, including healthcare, manufacturing, and professional services, often using common initial-access methods such as compromised credentials or unpatched vulnerabilities. The listing of Shamir Medical Center is presented by the group as a successful operation; that claim has not been independently confirmed in the available facts and should be treated as an unverified assertion by the threat actor.

About Shamir Medical Center

Shamir Medical Center is a large public hospital in Israel that provides a full range of acute and specialist care. Institutions of this type routinely hold extensive clinical records, administrative files, staff information, and operational data necessary for day-to-day patient treatment and hospital management. A breach at such a facility is consequential because healthcare organisations process highly sensitive personal and medical information whose compromise can affect patient privacy, continuity of care, and public trust. The group’s own statement describes the centre as the largest medical facility in Israel; regardless of exact ranking, its scale means any significant data exposure would touch a substantial patient population and workforce.

What was likely exposed

The only data types named in the available facts are “internal files” said to have been exfiltrated in a ransomware attack. The group claims the volume reached approximately 8 terabytes of sensitive and confidential material, but the precise contents of those files have not been itemised or independently verified. Hospitals of this kind typically maintain electronic health records, diagnostic images, billing and insurance data, staff personnel files, and internal operational documents. Whether any or all of those categories were among the material taken remains unconfirmed. Public detail is limited to the group’s assertion of internal-file exfiltration; no definitive inventory has been released.

The real-world impact

If the claimed exfiltration is accurate, individuals whose information appears in the stolen files could face risks of identity theft, medical-identity fraud, targeted phishing, or unwanted contact. For the hospital itself, the consequences may include operational disruption during recovery, regulatory scrutiny, notification obligations, and potential reputational damage. Even when encryption is reversed or systems are restored, the separate theft of data creates a longer-term exposure that cannot be undone by technical recovery alone. Because the number of people affected is unknown and the exact data types remain unconfirmed, the practical scale of these risks cannot yet be quantified from public information.

Were you affected?

If you have been a patient, employee, or contractor of Shamir Medical Center, treat the possibility of exposure seriously until more details emerge. Monitor financial and medical accounts for unusual activity, enable multi-factor authentication wherever available, and be cautious of unsolicited messages that reference the hospital or claim to offer breach-related assistance. Consider placing fraud alerts with credit bureaus if you reside in a jurisdiction that supports them. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan does not prove or disprove involvement in this specific incident but can indicate whether the address is circulating more broadly.

AICompiled with AI assistance from public sources and published under our editorial standards.