coosalud.com Listed by Threeam Ransomware Group

The group known as Threeam has listed Coosalud on its leak site. According to the listing, the Colombian health promotion entity (EPS) appears in connection with a ransomware-extortion incident. Coosalud has not publicly confirmed the claim as of this writing.

If customer records were taken, the absence of any enumerated categories in the filing means it is not possible to know which specific fields, if any, were involved. The record also does not state how many people were affected, nor does it provide an incident date—only the filing date of September 28, 2026.

What a Leak-Site Listing Actually Establishes

Ransomware groups routinely publish names of healthcare organisations on leak sites as part of standard extortion pressure. The listing itself is a claim made by the attacker, not independent verification. Many such postings later prove to be recycled data from earlier incidents, exaggerated claims, or sometimes entirely false. Real confirmation would require an admission or detailed notification from Coosalud itself, or findings published by a regulator. Until then, the listing remains an unverified accusation rather than established fact.

The Familiar Pattern in Healthcare Extortion

Healthcare providers and insurers are frequent targets in ransomware campaigns because the sensitivity of the sector creates strong incentives to pay quickly to avoid public embarrassment. Attackers know that even the threat of releasing patient-related records can generate pressure. This is why the same groups repeatedly list organisations in this industry using similar language. Recognising this pattern helps you treat future listings with appropriate scepticism instead of assuming every new claim represents a fresh, confirmed compromise.

What Remains in Your Control

Even without knowing the exact contents of the listing, basic precautions remain useful if you have ever been a Coosalud customer. Monitor your accounts for unusual activity. If you hold an account with them and reuse the same password on other services, changing that password is a low-cost step worth taking. Contact Coosalud directly if you want to confirm whether you are in any affected group; the organisation is required to notify impacted customers by letter when legally obliged to do so. Absence of a letter usually indicates you were not included, though anyone who has changed address should reach out to be certain.

GalaxyWarden provides continuous monitoring across 13.1B+ breach records and 100+ platforms, with identity-chain mapping and remediation handled by specialists.