Atenção Primária à Saúde Brazil Listed by Nova Ransomware Group

On December 4, 2025, the nova Ransomware Group added Atenção Primária à Saúde to its leak site, claiming to have stolen more than 50 million patient record lines contained in 100 GB of SQL files from Brazil’s national primary healthcare system.

Reported Details of the Breach

Public reporting indicates the attackers targeted systems hosted by Fix Tecnologia, including the platform at https://esusbelacruz.fixtecnologia.com.br/. The group states it exfiltrated internal SQL databases from both on-premise systems and cloud environments. No exact number of unique individuals has been confirmed, but the volume suggests records belonging to a significant portion of patients who have used Brazil’s primary care services.

The attackers say they will provide samples to the victim organization upon contact and appear to be following their standard playbook of extortion through data exposure. Available reporting describes the incident as a ransomware attack that resulted in both encryption and subsequent data theft.

Why This Matters for You and Your Family

If you or any member of your family has received care through Brazil’s public health system, your personal medical history, addresses, contact details, and possibly national identification numbers may now sit in a criminal database. Millions of patient records represent a treasure trove for identity thieves who combine health data with other leaks to build complete profiles.

Medical information is especially sensitive. It can be used for insurance fraud, prescription scams, blackmail, or simply to make impersonation attempts more convincing. Once your data leaves official hands, you cannot retrieve it. The breach therefore shifts the burden onto you to watch for misuse of your family’s information.

The Doxxing and Identity-Chain Risks

Health-system leaks rarely stay isolated. Criminals frequently link medical records to email addresses, phone numbers, and social-media handles found in other breaches. This creates an identity chain that can expose your home address, family relationships, and even your children’s names. Public reporting shows these chains often lead to doxxing, targeted phishing, or account takeovers on gaming platforms where kids use the same email or password.

Credential leaks like this one cascade into gaming account compromises when the same password protects both a health portal and a Roblox, Fortnite, or Steam account. Once an attacker controls a child’s gaming profile, they can harvest additional personal details shared in chats or linked payment methods, lengthening the identity chain further.

Nova Ransomware Group’s Track Record

Public reporting attributes the nova Ransomware Group with operations that emerged in recent years and a growing list of victims across government and healthcare sectors. The group typically gains initial access through phishing or exploited remote-desktop services, exfiltrates data before deploying ransomware, and then posts samples on its dark-web leak site to pressure payment. Their extortion style combines data publication threats with direct contact to the victim organization, a pattern consistent with the Atenção Primária à Saúde listing.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, family members’ handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your data appears for sale you learn within hours rather than months.
• Rotate any password you used on Brazilian health portals or related government sites and switch on 2FA through an authenticator app everywhere that password was reused.
• Cover the household with DoxxScan family protection that extends to your children’s gaming accounts, which often chain back to the same addresses and emails now exposed in this leak.
• Let remediation specialists handle takedown requests across data brokers and threat forums so you do not have to chase every site yourself.

The breach of Atenção Primária à Saúde shows how quickly public-health data can reach criminals and why waiting for official notifications is no longer enough. Start protecting your family today by understanding exactly where your information surfaces online. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to the same credential-stuffing attacks that follow leaks like this one.