AFECC - Hospital Santa Rita de Cássia Listed by incransom Ransomware Group

On June 19, 2025, the incransom ransomware group listed Hospital Santa Rita de Cássia on its leak site, claiming to have exfiltrated internal files from the Brazilian cancer-treatment and general-care facility.

What's Publicly Reported from Reporting

Public reporting indicates the hospital, founded in 1970, serves as a major philanthropic reference for cancer care in its state while also providing broader medical services. The incransom group posted details of the incident on its onion-based leak site, accessible via ransomware.live. Available reporting describes the exposed material as internal files obtained during a ransomware attack, though the exact volume and specific types of patient or employee records remain unconfirmed in initial disclosures. No precise victim count has been released, and the hospital has not yet issued a public statement detailing the scope of the breach.

Why This Matters for You and Your Family

When a hospital’s internal systems are compromised, the personal information of patients, their families, and staff can end up in the hands of criminals. Even if you were not treated at Santa Rita de Cássia, similar attacks on healthcare providers routinely expose names, dates of birth, addresses, medical histories, and sometimes Social Security or national ID numbers. Once that data reaches dark-web marketplaces, it can be used to file fraudulent tax returns, open accounts in your name, or launch more targeted scams against you and your children. Healthcare breaches remain among the most damaging because medical details are difficult to change and can be exploited for years.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one dataset. Criminals frequently cross-reference stolen hospital records with credentials from earlier breaches, creating detailed identity chains that link your email, phone number, family members’ names, and even children’s online gaming accounts. A single exposed medical file can give attackers enough context to impersonate you convincingly or to harass your family through doxxing. Public reporting shows these chains often lead to account takeovers on gaming platforms, social media, and financial services. Credential leaks like this one cascade into broader privacy violations that can affect every member of a household.