Shifa Oman Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare providers worldwide, treating patient-facing organisations as high-value victims whose operational disruption and sensitive records create strong leverage. Against that backdrop, a listing that appeared on 21 July 2025 has drawn attention to Shifa Oman, a private hospital in Muscat.

Public reporting states that the ransomware group known as thegentlemen has claimed responsibility for an attack in which internal files were exfiltrated. The number of people affected remains unknown, and many operational details have not been disclosed. The claim alone is enough to warrant careful scrutiny by patients, staff and partners who may have data held by the facility.

Breaking down the breach

According to available public information, Shifa Oman was listed by thegentlemen ransomware group on 21 July 2025. The group asserts that internal files were taken during a ransomware attack. No confirmed figure has been released for the volume of data, the number of systems involved, or the precise date the intrusion began. Methods of initial access, dwell time and any encryption of production systems are likewise undisclosed. The only concrete assertion in the public record is the group’s claim of exfiltration of internal files and the subsequent leak-site listing of the organisation.

Because independent confirmation of the full scope has not been published, the incident should be treated as an unverified claim of compromise until further evidence appears. Healthcare environments often contain interconnected clinical and administrative systems; any successful ransomware intrusion in such a setting raises the possibility of both data theft and service interruption, even when exact technical particulars remain limited.

Who is thegentlemen?

thegentlemen is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while also stealing data and threatening to publish it if payment is not made. Like many contemporary groups, it typically advertises victims on a dedicated leak site, using the listing itself as pressure. Public reporting on the group’s broader activity describes opportunistic targeting across multiple sectors rather than exclusive focus on any single industry. Specific claims the group has made about Shifa Oman beyond the listing and the assertion of internal-file exfiltration are not detailed in the available facts; those statements remain the group’s own assertions.

Who is Shifa Oman?

Shifa Oman, also referred to as Shifa Hospital, is a multispecialty private medical facility located in the heart of Muscat. Public descriptions characterise it as a fully fledged medical service provider whose purpose-built infrastructure is intended to meet international standards and to serve the healthcare needs of Oman’s population. As a private hospital it routinely handles clinical records, administrative data, billing information and communications with patients, staff and external partners. A breach affecting such an organisation is consequential because healthcare data is both sensitive and long-lived; compromise can affect medical privacy, continuity of care and institutional trust even when the precise scale of exposure is still unknown.

The information in question

The facts name the exposed material only as “internal files exfiltrated in [a] ransomware attack.” No further breakdown—such as patient records, staff credentials, financial documents or diagnostic imagery—has been confirmed in the public record. Organisations of this type typically hold medical histories, contact details, insurance or billing data, appointment schedules and internal operational documents. Because the exact contents remain unconfirmed, it is not possible to state which categories were taken. Readers should therefore treat any specific data-type claims that circulate without primary sourcing as unverified.

The real-world impact

For individuals, the principal risks centre on privacy and secondary misuse. If clinical or personal identifiers were among the internal files, affected people could face unwanted contact, identity-related fraud or embarrassment. Even administrative data can enable social-engineering attempts that reference real appointments or staff names. For the hospital itself, consequences may include operational disruption during recovery, regulatory scrutiny under applicable data-protection rules, reputational harm and the cost of forensic investigation and notification. Because the number of people affected is listed as unknown, the breadth of these effects cannot yet be quantified; the absence of a confirmed count does not eliminate the need for vigilance.

Were you affected?

If you are a current or former patient, employee or partner of Shifa Oman, treat the listing as a prompt to take basic protective steps while awaiting any official notification. Practical first measures include:

• Monitor bank, credit and insurance statements for unfamiliar activity.
• Be sceptical of unsolicited calls or messages that reference hospital visits or personal details.
• Change passwords for any accounts that may have reused credentials linked to hospital portals or email.
• Enable multi-factor authentication wherever it is offered.
• Retain copies of any formal breach notices you later receive for reference.

You can also run a free exposure scan of your email address to check whether that address has already appeared in other known breach data sets. Official updates from the hospital or relevant authorities remain the most reliable source of confirmation about this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.