Grupo SASMET Listed by Arcus Media Ransomware Group

On May 11, 2024, Colombian healthcare provider Grupo SASMET appeared on the leak site of the ransomware group ArcusMedia. The listing states that internal files were exfiltrated during a ransomware attack; the exact number of records affected and the specific types of data taken remain undisclosed by both the group and the victim.

Reported Details from the Listing

The ArcusMedia leak page, accessible via the .onion link indexed by ransomware.live, shows Grupo SASMET as a confirmed victim. It claims successful data exfiltration but provides no sample files, no ransom amount, and no deadline for publication. The disclosure indicates that the files are internal company documents obtained after the ransomware deployment. No public breach notification from Grupo SASMET has surfaced detailing the incident timeline or scope, leaving the full extent of exposure unknown at this time.

Why This Matters for You and Your Family

When a healthcare organization like Grupo SASMET suffers a ransomware breach, the people whose medical records, billing information, or personal identifiers sit in those internal files face direct risk. Even without exact record counts, the exposure of internal files in healthcare almost always includes names, dates of birth, national identification numbers, addresses, and clinical details. That combination is enough for identity thieves to open accounts, file fraudulent tax returns, or impersonate patients for prescription fraud. Your family’s health privacy is now partially in the hands of criminals who have already demonstrated willingness to publish stolen data.

Doxxing and Identity-Chain Risks

Healthcare breaches rarely stop at the initial leak. Criminals routinely cross-reference exposed patient data with other breaches to build persistent identity chains. An email address allegedly taken from Grupo SASMET can be matched to credential-stuffing results from earlier incidents, linking your work account, personal accounts, and even children’s gaming profiles that share the same recovery phone number or address. Once those links exist, doxxing escalates quickly: public records, social-media handles, and family relationships become visible to anyone who buys the dataset. Credential leaks like this one cascade into account takeovers that affect not just the patient but every household member tied to the same contact details.

ArcusMedia’s Known Track Record

Public reporting attributes ArcusMedia’s first notable campaigns to late 2023. The group has since listed healthcare providers, manufacturers, and professional-services firms across Latin America and Europe. Their typical playbook begins with phishing or compromised remote-desktop credentials, followed by lateral movement, data exfiltration, and then dual extortion: demanding payment to prevent both encryption and data publication. ArcusMedia maintains a leak site that updates within days of an unmet ransom deadline, often releasing compressed archives in batches. While the group is not among the largest ransomware operations, its steady pace and focus on mid-sized organizations make it a persistent threat to companies whose data directly touches ordinary families.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any ties to Grupo SASMET patient portals or billing systems.
• Rotate passwords used at Grupo SASMET or any connected healthcare provider anywhere they are reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email listed in medical files.
• Let remediation specialists handle ongoing takedown requests for any personal information already appearing on data-broker or extortion sites.

The Grupo SASMET breach is a reminder that healthcare providers remain high-value targets whose compromises quickly become personal compromises for patients. One short DoxxScan trial followed by continuous monitoring gives you the earliest warning and the clearest remediation path when the next leak appears. Start your DoxxScan trial today and extend coverage to every member of your household, including gaming accounts that could otherwise become the next link in an identity chain.