Consorci Sanitari Integral & Geseme Listed by ransomexx Ransomware Group

On October 11, 2022, the Spanish healthcare provider Consorci Sanitari Integral and its affiliated entity Geseme appeared on the leak site of the ransomware group known as RansomEXX. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of records affected and the specific data types contained in those files remain undisclosed by both the group and the victim organization.

Details in the RansomEXX Listing

The primary disclosure on the RansomEXX onion site indicates that both Consorci Sanitari Integral (CSI) and Geseme had data stolen and that the files are now published for anyone to download. CSI is a public consortium providing healthcare and social services in the Barcelona area, formed in 2000 from former Red Cross hospitals and jointly governed by Catalan health authorities, local municipalities, and the Red Cross itself. The leak-site entry does not quantify the volume of data, list the precise categories of information taken, or specify a ransom demand or payment deadline. Public reporting on RansomEXX confirms that the group typically posts samples or full archives once negotiations fail.

Why This Matters for You and Your Family

When a healthcare provider’s internal files are stolen and published, the exposure can directly affect patients, employees, and their households. Medical records, appointment details, billing information, employee payroll data, or supplier contracts may be inside the archive even if the listing does not explicitly name those categories. Once such material reaches the public internet, it never truly disappears. Anyone whose name, national ID number, address, or medical history appears in the leak faces long-term risk of identity theft, insurance fraud, or targeted scams that feel personal because the criminals already hold sensitive context about their health or finances.

Doxxing and Identity-Chain Risks

Healthcare breaches like this one frequently serve as the starting link in larger doxxing chains. A single email address or phone number allegedly taken from CSI’s systems can be correlated with gaming accounts, social-media handles, or family-member records found in other leaks. Attackers then build a complete profile that links your professional life, medical background, and children’s online identities. Credential reuse across personal and work accounts turns one breach into multiple account takeovers. Children’s gaming profiles tied to the same household address are especially vulnerable because gamers often reuse passwords or security questions that appear in adult medical or employment files.

RansomEXX’s Known Track Record

Public reporting attributes the first significant activity by RansomEXX to late 2020. The group has since targeted organizations across Europe and Latin America, with a focus on government entities, manufacturers, and healthcare providers. Notable prior victims include the Brazilian court system and several European transportation and logistics companies. Their typical playbook involves initial access through compromised remote-desktop credentials or vulnerable VPNs, followed by exfiltration of sensitive files before encryption. When ransom is not paid, RansomEXX publishes the data on their leak site and sometimes offers the archive for sale to third parties, extending the exposure window indefinitely.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly where CSI-related data may surface.
• Rotate any password you ever used at Consorci Sanitari Integral or Geseme and enable 2FA with an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches you or your family is flagged within hours rather than months.
• Cover the entire household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal documents or broker listings that result from this incident.

The incident underscores that healthcare data breaches continue to surface years after the initial compromise, quietly feeding the extortion economy. One practical step today can break the chain before criminals connect your medical history to every other part of your digital life. DoxxScan’s continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage give you and your family an effective way to stay ahead of these cascading risks.