Cooperativa de Hospitales de Antioquia - COHAN Listed by qilin Ransomware Group

On April 20, 2026, Cooperativa de Hospitales de Antioquia (COHAN), a hospital cooperative in Colombia, appeared on the leak site of the qilin ransomware group. The attackers claim to have stolen internal files during a ransomware incident and have published a sample of the allegedly exfiltrated data.

Reported Details from Reporting

Public reporting indicates that COHAN was listed on the qilin ransomware group’s leak portal. The group states it obtained internal documents and has begun releasing samples as part of its extortion process. The exact number of affected individuals remains unknown, and the specific types of records exposed have not been independently verified beyond the group’s claims. Available reporting describes the incident as a classic ransomware attack involving both encryption of systems and subsequent data exfiltration.

Why This Matters for You and Your Family

When a healthcare organization like COHAN suffers a breach, the data involved often includes personal details that can be traced back to patients, employees, and their families. Medical records, addresses, phone numbers, and identification documents are frequently part of hospital cooperative files. Once this information reaches criminal marketplaces, it can be used for identity theft, insurance fraud, or targeted scams against you or your relatives. Even if you never directly interacted with COHAN, shared vendor systems or family members who live in the region may have had their information stored in the cooperative’s networks.

The Doxxing and Identity-Chain Risks

Stolen internal files rarely stay isolated. Attackers and subsequent buyers can combine leaked emails, employee lists, or patient contact details with information from other breaches to build complete identity profiles. These chains often extend to social media handles, family relationships, and even children’s online gaming accounts. A single exposed work email can lead to credential stuffing attempts across personal services, quickly escalating into full doxxing. Credential leaks like this one frequently cascade into account takeovers precisely because the same passwords or password patterns are reused at home and for children’s gaming profiles.

Qilin Ransomware Group’s Known Track Record

Public reporting attributes the qilin ransomware operation to a group that emerged in 2022. The gang has targeted organizations across healthcare, education, and manufacturing sectors in multiple countries. Its typical playbook involves gaining initial access through phishing or exploited vulnerabilities, exfiltrating sensitive files before deploying ransomware, and then using dual extortion: demanding payment to decrypt systems and threatening to publish stolen data on its leak site if the ransom is not paid. Past victims have included hospitals and municipal agencies, with the group consistently releasing sample documents to pressure targets.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to this incident.
• Rotate any password you ever used at COHAN or related healthcare providers anywhere it has been reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes dependents and your children’s gaming accounts that often chain back to the same addresses and family names.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or shady removal services.

The COHAN breach is a reminder that healthcare data leaks continue to surface long after the initial attack is announced. Taking concrete steps now limits how far criminals can travel down the identity chain created by this and future incidents. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts. Starting your DoxxScan trial gives you and your family the earliest possible warning and expert assistance when the next leak appears.