Centromedicoenova Listed by Cloak Ransomware Group

On January 30, 2025, the Spanish healthcare provider Centromedicoenova appeared on the public leak site of the cloak ransomware group, with attackers claiming to have exfiltrated internal files in a ransomware incident that exposed data belonging to an unknown number of patients and staff.

What Public Reporting Shows

Public reporting indicates the organization, based in Spain, was listed on the cloak leak portal with a sample of the stolen data made available for download. The posted volume is listed as under 100GB, and the entry carries a public view count of 69 as of the initial reporting. Available details describe the incident as a ransomware attack in which internal files were allegedly exfiltrated, though the precise number of individuals affected remains unknown. No specific patient names, medical records, or financial details have been independently verified in open sources, but the presence of the listing on a ransomware leak site states that attackers possess and are willing to publish the stolen material.

Why This Matters for You and Your Family

When a healthcare provider’s internal files are stolen, the information often includes names, addresses, dates of birth, national identification numbers, insurance details, and clinical notes. Any of these can be used to commit identity theft, file fraudulent tax returns, open accounts in your name, or impersonate you when dealing with insurers or government agencies. For families, a single breach can expose every member listed in shared medical records, including children. Once that data reaches criminal marketplaces, it rarely disappears. The cloak group’s decision to list Centromedicoenova publicly raises the risk that your information, if present, is now available to identity thieves, doxxers, and fraud rings who routinely scan fresh ransomware leaks for usable records.

The Doxxing and Identity-Chain Implications

Medical data rarely travels alone. A leaked email or phone number from a healthcare breach frequently links to accounts on other services through password reuse or shared contact details. Attackers map these connections, turning one breach into a chain that can expose social-media profiles, children’s gaming accounts, home addresses, and family relationships. Credential leaks like this one regularly cascade into account takeovers, especially on platforms where security is weaker. Gaming accounts belonging to children are particularly vulnerable because they often share the same email addresses or passwords used for family medical portals. The result is a widening web of personal information that can be exploited for harassment, extortion, or further fraud. Continuous monitoring across 13.1B+ breach records and 100+ platforms combined with identity-chain mapping is one of the few practical ways to detect these expanding links before damage spreads.