🏥 Healthcare & Life Sciences¶

Providers, health tech, pharma, biotech, medical devices · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D2▼ −14

Prior 30D16

Active actor L90DUnknown · 4

Active actor L90DShinyHunters · 4

Active actor L90DN0n · 2

Today — 03 Nov 2026¶

No industry-tagged items in today's briefing — see recent activity below.

Last 14 days¶

UNM Health System (Albuquerque, NM) diverted ambulances and canceled appointments across 30+ clinics after "a cybersecurity issue" — company-confirmed disruption, no actor or cause yet disclosed.HighHealthcare & Life SciencesNew Mexico's only Level 1 trauma center told patients to use 911 for emergencies while it worked through the incident. No ransomware or extortion claim has been corroborated against this specific 2026 UNM Health incident — a widely-aggregated "Byod ransomware" attribution traced back to an unrelated 2024 UMC Health System (Lubbock, TX) story and is not treated as real. Watching for attribution and scope in a future run. AP via AJC · Albuquerque Journal

Quest Diagnostics discloses unauthorized access to its Quanum LSM lab-order system; patient records affected, scope not yet determined.CriticalHealthcare & Life SciencesThe company's Oct 21 SEC 8-K says it learned of the intrusion that day, has activated incident-response procedures, notified federal law enforcement and engaged outside cybersecurity experts. Quest believes an unauthorized party accessed "certain patient records" but has not yet disclosed a count or data-type breakdown; distinct from Quest's 2019 AMCA vendor breach (~11.9M patients) and 2021 ransomware incident — not a recycled event. SEC 8-K

Recent victim claims¶

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 21 Quest Diagnostics Unknown Ransomware · healthcare / diagnostics · USA SEC 8-K discloses unauthorized access to Quanum LSM, the lab-order/results system clients use; company believes certain patient records were accessed, full scope still under investigation; federal law enforcement notified. · Sources: SEC 8-K

Oct 13 Topcon Healthcare Everest Ransomware · healthcare technology · Netherlands Everest ransomware group listed Topcon Healthcare, a Netherlands-based eye-care diagnostics and digital-health vendor, on its leak site, claiming roughly 245GB of data. No company statement, regulatory filing, or independent corroboration found beyond the aggregator listing; treat as an unverified claim. · Sources: Breachsense

Oct 03 St. Francis Healthcare Systems of Hawaii Wallstreet Ransomware · Healthcare & Life Sciences · USA Catholic nonprofit healthcare system; operational disruption alleged. Claimed by nascent group Wallstreet (emerged early 2026). Unverified DLS claim. · Sources: Ransomware.live · DeXpose

Oct 01 Hospital Hermilio Valdizán RansomHouse Ransomware · healthcare · Peru Lima public psychiatric hospital (MINSA); data-theft claim, no encryption, estimated attack date ~Aug 21; no scope disclosed, no hospital confirmation. · Sources: ransomware.live · GalaxyWarden

Oct 01 Houston Thyroid & Endocrine Specialists N0n Ransomware · healthcare · USA Houston, TX endocrinology practice; claim listed, no scope disclosed, no confirmation. · Sources: GalaxyWarden

Oct 01 Associated Gastroenterologists of Central New York, P.C. Booba Project Ransomware · Healthcare & Life Sciences · USA Medical practice; ~70GB of medical/patient data claimed exfiltrated. Unverified DLS claim. · Sources: Ransomware.live · HendryAdrian

Oct 01 Dexcom ShinyHunters Extortion · Healthcare & Life Sciences · US ShinyHunters listed Dexcom alongside O'Reilly Automotive on its dark-web leak site Oct 1, threatening to publish data absent contact; listing deleted Oct 3 (removal pattern consistent with, but not proof of, negotiation). No company confirmation found. Unverified claim. · Sources: Cybernews

September 2026

Sep 30 Pulmonary Services Group The Gentlemen Ransomware · Healthcare & Life Sciences · Puerto Rico Home medical equipment/respiratory-therapy provider (Santurce/San Juan and Mayaguez) listed on The Gentlemen's leak site; estimated attack date Sep 29; no company confirmation. · Sources: Ransomware.live · GalaxyWarden

Sep 28 Carolina Asthma & Allergy Center Chaos Ransomware · Healthcare · USA Healthcare provider listed on Chaos's leak site; claim covers ~290GB including patient forms (names, DOB, MRN, SSNs, phone/address) plus administrative/financial documents, with a reported 24-hour ultimatum. Unverified claim, no company confirmation. · Sources: Ransomware.live · DeXpose

Sep 25 Anery LockBit5 Ransomware · home healthcare · Brazil Brazilian home-healthcare provider (anery.com.br) listed on LockBit5's leak site; no company confirmation. · Sources: Ransomware.live

Sep 24 Welgen One Incransom Ransomware · healthcare services · USA Atlanta-based healthcare/wellness services provider listed on Incransom's leak site; no company confirmation. · Sources: Ransomware.live

Sep 21 Forma Therapeutics Holdings Nightspire Ransomware · Pharmaceuticals · US Listed on Nightspire's leak site; unverified claim, no company confirmation. · Sources: Ransomware.live

Sep 20 ARS Renacer, S.A. DragonForce Ransomware · healthcare · Dominican Republic DragonForce claimed Sep 20 to have compromised ARS Renacer, a Dominican Republic health-insurance provider, exposing sensitive medical and financial data for thousands of affiliates. No company confirmation. DLS claim only. · Sources: DeXpose

Sep 20 Great Bay Bio NightSpire Ransomware · healthcare · Hong Kong NightSpire listed Great Bay Bio, a Hong Kong biotech firm, on its leak site Sep 20, claiming exfiltration of sensitive data. No company confirmation. DLS claim only. · Sources: DeXpose · GalaxyWarden

Sep 18 AstraZeneca Turkiye N0n Ransomware · Pharmaceuticals · Turkey N0n claims 940MB internal network-security configuration across three sites plus 1.35M connection records; unverified DLS claim, Sep 21 deadline · Sources: https://www.redpacketsecurity.com/n0n-ransomware-victim-astrazeneca-turkiye/

Sep 11 Imperial Healthcare Solutions Qilin Ransomware · healthcare · US Qilin DLS listing Sep 11, 2026; listing carries no stated data volume, ransom demand, or publication deadline and no substantive description of the intrusion; data scope and impact unconfirmed · Sources: Ransomware.live · RedPacketSecurity

Sep 10 General Santos Doctors Hospital Rhysida Ransomware · healthcare · Philippines Rhysida lists a 280-bed Level 3 tertiary hospital in South Cotabato, claiming roughly 3.5M files (2.44TB) exfiltrated including name-tagged diagnostic scans, cancer-center records with PhilHealth IDs, lab quotations with birth dates, and a staff register with PRC license numbers. No hospital confirmation yet; verify before treating as a breach. · Sources: Ransomware.live

Sep 08 Veradigm The Gentlemen Ransomware · healthcare technology · US Chicago-based EHR/e-prescribing/practice-management vendor confirms an attacker used compromised third-party vendor credentials to access a specific Veradigm API and download patient data, including Social Security numbers for a subset of customers; no clinical/medical data, network or server compromise. The Gentlemen posted Veradigm to its leak site Sep 5, asserting 3.5M patient records (names, addresses, SSNs, emails, phones) were taken, and set a Sep 11 publication deadline absent ransom negotiation. The access itself is company-confirmed; the 3.5M-record scope is the attacker's own figure. · Sources: BleepingComputer · The Record

Sep 03 DiaSorin S.p.A. Settra Ransomware · Healthcare / Diagnostics · Italy Settra DLS claim Sep 3 2026; Italian in vitro diagnostics multinational (EURONEXT Milan: DIA); data scope and volume not disclosed. 🟥 Unverified DLS claim. · Sources: https://www.dexpose.io/settra-ransomware-attack-on-diasorin-s-p-a/

Sep 03 MedEvolve Settra Ransomware · Healthcare · USA Settra DLS claim Sep 3 2026; US medical billing and practice management software provider; ~820GB exfiltrated; estimated attack date Aug 11 2026. 🟥 Unverified DLS claim. · Sources: https://www.dexpose.io/settra-ransomware-attack-on-medevolve/

August 2026

Aug 25 National Kidney Registry Direwolf Ransomware · Healthcare · US Organ donor-recipient matching nonprofit; DLS claim Aug 25. Five healthcare victims for Direwolf in 16 days. 🟥 Unverified DLS claim. · Sources: https://www.ransomware.live/group/direwolf

Aug 25 McKesson Corporation ShinyHunters Extortion · Healthcare · USA ShinyHunters claimed theft of 284M patient data records via third-party application compromise; McKesson confirmed the incident in an SEC 8-K and launched investigation; data allegedly includes names, SSNs, DOBs, patient IDs, Medicaid numbers, medical records, medications — 284M is raw record count, unique individual count TBD; claim unverified · Sources: https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/

Aug 25 Boston Scientific Unknown Ransomware · Healthcare · USA Cyberattack caused global IT disruption; systems supporting order processing and shipment affected; Cork Ireland manufacturing facility workers sent home; investigation by third-party incident response firm ongoing; actor unattributed; timeline for restoration unknown · Sources: https://techcrunch.com/2026/08/26/medical-device-maker-boston-scientific-says-a-cyberattack-is-causing-a-global-disruption-to-its-operations/

Aug 22 NovoCure ShinyHunters Extortion · Healthcare / Medical Devices · USA ShinyHunters DLS claim Aug 22 2026; NovoCure (NYSE: NVCR) makes Tumor Treating Fields cancer-treatment devices; data scope and deadline not publicly confirmed; 🟥 unverified DLS claim · Sources: RansomLook

Aug 22 Integrated Health Systems CoinbaseCartel Ransomware · Healthcare · USA CoinbaseCartel DLS claim Aug 22 2026; Integrated Health Systems (ihs911.com) is a US healthcare provider; data-theft extortion with 48h contact window, 10-day payment deadline; data scope unconfirmed; 🟥 unverified DLS claim · Sources: DEXpose

Aug 20 Hospital for Sick Children (SickKids) Unknown Ransomware · Healthcare · Canada Employee and job-applicant personal data exposed via vulnerability in unnamed third-party careers website software; clinical systems and patient data not affected; SickKids, Boomerang Health, SickKids Foundation employees and applicants impacted; vendor unnamed suggesting wider supply-chain exposure · Sources: CP24 · BleepingComputer · The Record

Aug 14 Baxter International ShinyHunters Extortion · Healthcare / Medical Technology · USA ShinyHunters DLS claim August 14 2026 against Baxter International; 7.1 million Salesforce records with PII claimed; extortion deadline was August 17; as of August 22 no data has been published · Sources: https://www.hookphish.com/blog/ransomware-group-shinyhunters-hits-baxter-international-inc/

Aug 13 SIA Medical Centre Rhysida Ransomware · Healthcare · AU Rhysida DLS claim August 13, 2026; SIA Medical Centre Melbourne; scope unconfirmed. · Sources: https://www.ransomware.live/group/rhysida

Aug 13 Philips Clop Extortion · Healthcare Technology · NLD Clop listed Philips on DLS in mass PTC Windchill/FlexPLM campaign (CVE-2026-12569); claimed 13.5GB of PDF drawings, diagrams and blueprints. Philips confirmed an investigation is underway. DLS claim — breach not confirmed. · Sources: https://www.technadu.com/shell-and-philips-confirm-investigation-following-cl0p-data-theft-claims-targeting-nearly-50-companies-including-fiserv-and-ge/633182/

Aug 10 Unlimited Technology Systems Unknown Ransomware · Healthcare Technology · US Ohio-based healthcare revenue cycle management firm; breach Oct 5-10 2025; detected Oct 19 2025; HHS OCR notification filed late July 2026 confirming 3,803,750 individuals affected; SSNs DOBs medical/insurance data stolen; largest healthcare breach of 2026 YTD by victim count · Sources: https://www.securityweek.com/3-8-million-impacted-by-unlimited-technology-systems-data-breach/

Aug 10 Quironsalud Direwolf Ransomware · Healthcare · Spain Spain's largest private hospital group (50+ hospitals, ~13,000 beds). Attack discovered Aug 10; DLS claim Aug 10-11. 🟥 Unverified DLS claim. · Sources: https://www.dexpose.io/direwolf-ransomware-attack-on-quironsalud-spains-health-giant/

Aug 04 BLACKBURN's Physicians Pharmacy Anubis Ransomware · Healthcare / Pharmacy · US Anubis ransomware DLS claim approximately August 3-4 2026; US healthcare pharmacy; no statement from BLACKBURN's; data scope and impact unconfirmed · Sources: https://www.ransomware.live/

Aug 03 Amgen Unknown Ransomware · Pharmaceutical / Biotech · US Unauthorized access to third-party cloud systems detected July 2026; PHI and proprietary company data exfiltrated; Amgen disclosed via SEC 8-K filing approximately August 3; forensic investigation ongoing; no patient count disclosed; no operational disruption reported; no threat actor claimed credit · Sources: https://therecord.media/amgen-hackers-cyberattack-sec https://www.bleepingcomputer.com/news/security/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info/

Aug 03 Cameron Regional Medical Center Anubis Ransomware · Healthcare · US Anubis ransomware DLS claim August 3 2026; regional US medical centre; no statement from Cameron Regional; data scope and impact unconfirmed · Sources: https://www.ransomware.live/

Aug 02 ProHealth Medical Group Krybit Ransomware · Healthcare · Singapore Krybit DLS claim August 2: 114 GB of data claimed exfiltrated from Singapore healthcare provider ProHealth Medical Group Pte Ltd (prohealth.sg). Patient and operational data scope unconfirmed; no victim statement. 🟥 DLS claim only. · Sources: https://www.dexpose.io/krybit-ransomware-targets-singapores-prohealth-medical-group/ · https://www.redpacketsecurity.com/krybit-ransomware-victim-www-prohealth-sg/

Aug 02 ProHealth Medical Group Pte Ltd Krybit Ransomware · Healthcare · SGP Krybit ransomware posted DLS claim Aug 2; 114GB data claimed from Singapore primary healthcare provider (11 clinics). Krybit also targeted Actini Group (France) Aug 10. · Sources: https://www.dexpose.io/krybit-ransomware-targets-singapores-prohealth-medical-group/

Aug 01 Alcon Inc. ShinyHunters Extortion · Medical Devices / Ophthalmology · Switzerland ShinyHunters DLS posting August 1 2026 with August 4 contact deadline; claims 25M+ Salesforce records with PII; Alcon is a global ophthalmology medical device and pharmaceutical company; no statement from Alcon; data not yet published · Sources: https://www.redpacketsecurity.com/shinyhunters-ransomware-victim-alcon-inc/ https://www.dexpose.io/shinyhunters-breach-alcon-inc/

Aug 01 Lumenis Ltd. ShinyHunters Extortion · Medical Devices / Laser Systems · Israel ShinyHunters DLS posting August 1 2026 with August 4 contact deadline; claims 1.1M+ customer and employee records plus 176 GB internal corporate data; Lumenis manufactures surgical and aesthetic laser systems; no statement from Lumenis; data not yet published · Sources: https://www.redpacketsecurity.com/shinyhunters-ransomware-victim-lumenis-ltd/ https://breachnews.com/breaches/shinyhunters-lists-questel-alcon-and-lumenis-on-leak-site-with-new-extortion-claims/

July 2026

Jul 31 Hawaii Family Dental Qilin Ransomware · Healthcare · US Qilin posted Hawaii Family Dental on DLS July 31; dental healthcare provider; Qilin exploiting CVE-2026-0257 (PAN-OS GlobalProtect) as primary initial access; 1358+ cumulative Qilin victims · Sources: https://www.ransomware.live/ https://cybersecuritynews.com/qilin-ransomware-claims-1358-victims/

Jul 28 Affinia Healthcare Termite Ransomware · Healthcare · US St. Louis multidisciplinary medical system; Termite ransomware DLS posting July 28 2026; class action investigation opened; data scope unconfirmed; 🟥 unverified DLS claim · Sources: https://www.redpacketsecurity.com/termite-ransomware-victim-affinia-healthcare/

Jul 27 MCBS (Medical Computer Business Services) PEAR Ransomware · Healthcare · US Healthcare revenue cycle management firm; 1,261,464 patients exposed across 7 healthcare providers; 3TB data allegedly exfiltrated; 5-day compromise Sep 22-26 2025; not detected until May 28 2026; PEAR operates without encryption (pure extortion) · Sources: https://www.securityweek.com/mcbs-data-breach-affects-1-2-million-individuals/

Jul 25 Principle Diagnostics Laboratory Qilin Ransomware · Healthcare · Unknown DLS posting July 25 2026 by Qilin. Diagnostic laboratory; sector confirmed, country unconfirmed. · Sources: https://www.ransomware.live/

Jul 25 AnMed Health System Unknown Ransomware · Healthcare · US 79 of 106 facilities closed including oncology, radiation, infusion, and imaging services; 72-hour ransom demand issued; FBI and SLED investigating; class action investigations underway · Sources: https://www.hipaajournal.com/anmed-closes-almost-80-facilities-while-it-grapples-with-cyberattack/ · https://www.healthcareitnews.com/news/anmed-given-72-hours-respond-demands-ransomware-incident

Jul 23 LAXAI Life Sciences Krybit Ransomware · pharmaceutical / CDMO · India Krybit DLS claim July 23, 2026; LAXAI Life Sciences Pvt. Ltd. is a Contract Research, Development, and Manufacturing Organization (CRDMO) based in India; data scope and impact unconfirmed; 🟥 unverified · Sources: https://www.dexpose.io/krybit-ransomware-targets-laxai-life-sciences-in-india/ · https://www.cyfirma.com/news/weekly-intelligence-report-31-jul-2026/

Jul 20 Advantage Home Health Care The Gentlemen Ransomware · healthcare · US US home healthcare company claimed by The Gentlemen extortion group July 20; no confirmation from organization · Sources: https://www.ransomware.live/

Jul 18 Droguería Martorani Qilin Ransomware · healthcare (pharmaceutical distribution) · Argentina Argentine medical and hospital products importer/distributor, Buenos Aires; Qilin DLS claim Jul 18, 2026; founded 1970 by Luis Alberto Martorani; distributes medical equipment nationally; 🟥 unverified · Sources: https://ransomware.live/id/RHJvZ3VlcsOtYSBNYXJ0b3JhbmlAcWlsaW4=

Jul 18 Abbott Laboratories (Exact Sciences) ShinyHunters Extortion · healthcare (medical devices / cancer diagnostics) · US Abbott confirmed Jul 18, 2026 unauthorized access to limited systems in Cancer Diagnostics (Exact Sciences) business; ShinyHunters DLS claim alleges exfil of Microsoft Entra/ServiceNow/SharePoint/Databricks/Coupa data; claims: 30M+ rows customer PII, 1M+ SSNs, 22M+ medical order records, doctor-patient notes, NDAs; DLS deadline extended to Jul 21; ShadowByt3$ claims separate LabCentral portal breach under parallel investigation; Abbott has not confirmed data theft scope; 🟥 unverified · Sources: https://www.bleepingcomputer.com/news/security/abbott-laboratories-probes-two-cyber-incidents-amid-extortion-claims/ · https://cybernews.com/news/abbott-laboratories-breach-shinyhunters/ · https://www.abbott.com/en-us/corpnewsroom/diagnostics-testing/abbott-statement-on-cyber-incident-in-cancer-diagnostics-business

Jul 08 Dignity Health St. Mary's Medical Center Akira Ransomware · healthcare · hospital/US acute-care hospital (232 beds); Akira DLS claim April 2026; 41 GB claimed including employee passports, SSNs, government IDs, contracts, NDAs; victim notification letters sent July 2026; attack date estimated April 2026; 🟥 unverified — hospital has not issued public statement confirming breach · Sources: [ClassAction.org] · [BleepingComputer]

Jul 08 Aesthetic Surgical Images INC Ransom Ransomware · healthcare · plastic surgery/US INC Ransom DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/incransom · Sources: [SharkStriker] · [ransomware.live]

Jul 08 Shanghai Xuerong Biotechnology Co., Ltd. KRYBIT Ransomware · biotechnology · China KRYBIT DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/krybit · Sources: [SharkStriker] · [ransomware.live]

Jul 07 Next Clinics Qilin Ransomware · healthcare · US Qilin DLS claim July 7, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 06 Asisken Wallstreet Ransomware · medical assistance · unknown Wallstreet DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/wallstreet · Sources: [ransomware.live]

Jul 04 Baraga County Memorial Hospital Wallstreet Ransomware · healthcare · US Baraga County Memorial Hospital in L'Anse, Michigan; Wallstreet DLS claim July 4, 2026; data scope and impact unconfirmed; attack in reduced-staffing US Independence Day holiday window; 🟥 unverified · https://www.ransomware.live/ · Sources: [ransomware.live]

Jul 04 Abbott Laboratories (LabCentral) ShadowByt3dollar Ransomware · Healthcare / Medical Devices · USA API exfiltration of LabCentral customer portal from July 4; actor claims CE certificates, manufacturing specs, regulatory documents. Distinct from ShinyHunters Exact Sciences SSO incident (seq 478). Abbott investigating both simultaneously. · Sources: https://www.bleepingcomputer.com/news/security/abbott-laboratories-probes-two-cyber-incidents-amid-extortion-claims/

Jul 02 DISS Krybit Ransomware · medical technology · US Krybit DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/krybit · Sources: [ransomware.live]

Jul 02 Colorado Rehabilitation & Occupational Medicine INC Ransom Ransomware · healthcare · US Colorado-based rehabilitation and occupational medicine practice; INC Ransom DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/incransom · Sources: [ransomware.live]

Jul 02 Quest Healthcare Solutions Anubis Ransomware · healthcare · US employee data and internal files claimed exfiltrated; Anubis DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.hendryadrian.com/ransom-quest-healthcare-solutions-jul-2026/ · https://www.ransomware.live/group/anubis · Sources: [hendryadrian.com] · [ransomware.live]

Jul 01 Azienda Ospedaliera Moscati Krybit Ransomware · healthcare · Italy Italian public hospital; Krybit DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/krybit · Sources: [ransomware.live]

Jul 01 Centre Ophtalmologique d'Ermont The Gentlemen Ransomware · healthcare · ophthalmology/France French ophthalmology centre; The Gentlemen DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.breachsense.com/breaches/2026/july/ · Sources: [Breachsense]

Jul 01 Golden State Orthopedic Brain Cipher Ransomware · healthcare · orthopedics/US orthopedic healthcare provider; Brain Cipher DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]

← All industries · Victim database →