Centro de Especialidades Listed by thegentlemen Ransomware Group

On March 16, 2026, the ransomware group known as thegentlemen added Centro de Especialidades Anzoátegui, CA (CEACA) to its public leak site, claiming that internal files had been exfiltrated from the Venezuelan medical center that has served patients in eastern Venezuela and the Caribbean since 1971.

Reported Details from Reporting

Public reporting indicates the medical center’s network was compromised in a ransomware incident. The group posted proof of access on its dark-web leak site, accessible via the .onion address hosted on the ransomware.live tracker. Available details show that internal files were taken, although the exact number of patient records or specific data types remains unclear from current public posts. The listing appeared without an immediate public deadline for payment, consistent with the group’s pattern of gradually increasing pressure after initial exfiltration.

CEACA provides emergency care, specialized consultations, surgery, and intensive care for adults and newborns. Any patient records, appointment logs, billing information, or staff documents stored on its systems could therefore be part of the stolen material.

Why This Matters for You and Your Family

When a medical provider loses control of internal files, the information exposed often includes names, dates of birth, national ID numbers, addresses, phone numbers, medical histories, and sometimes insurance or payment details. For patients in Venezuela or the Caribbean islands who have visited CEACA since 1971, this creates a permanent risk: once data leaves the clinic’s control, it can circulate on criminal forums for years.

Medical data combined with contact details makes identity theft, insurance fraud, and targeted scams easier. Families may face fraudulent bills, phishing texts pretending to be from doctors, or blackmail attempts using sensitive health information. Children’s records, if included, are especially valuable to criminals because a minor’s data can remain useful for decades.

The Doxxing and Identity-Chain Risk

Stolen medical files rarely stay isolated. Attackers routinely cross-reference exposed names, emails, and phone numbers against other breaches. A single credential from this incident can unlock social-media accounts, online shopping profiles, or even children’s gaming accounts that reuse the same password or email. This creates an identity chain that links your real name and address to every online handle you or your family members use.

Once the chain is mapped, doxxing becomes straightforward. Criminals can publish home addresses, family member names, and medical conditions on public forums, leading to harassment, stalking, or further extortion. Credential leaks like this one frequently cascade into account takeovers precisely because people reuse passwords across work, health, and gaming services.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024 as a ransomware operation that combines double-extortion tactics with selective data leaks. The group has listed healthcare providers, educational institutions, and small-to-medium businesses across Latin America and Europe. Its typical playbook begins with initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files before encryption. If ransom demands are ignored, thegentlemen publishes samples or full datasets on its leak site, using the threat of further exposure to pressure victims. Exact success rates and total victims remain difficult to verify, but industry trackers consistently link the group to healthcare breaches where patient privacy is directly at stake.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from this and earlier breaches.
• Rotate the password you used for any CEACA patient portal or associated email account, then enable 2FA through an authenticator app on every service where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing daily life.

The incident at CEACA illustrates how quickly a single healthcare breach can feed larger identity chains that threaten families for years. Taking concrete steps now limits the damage and reduces the chance that today’s leak becomes tomorrow’s harassment or financial loss. DoxxScan by GalaxyWarden delivers that protection through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.