Hospital El Cruce Listed by Medusa Ransomware Group

On January 19, 2025, Hospital El Cruce in Argentina appeared on the leak site of the Medusa ransomware group after attackers exfiltrated 761.60 GB of internal files from the 130-bed public hospital that provides advanced diagnostics and specialized surgeries.

What Public Reporting Shows

Public reporting indicates the hospital, located at 5401 Av. Calchaqui in Florencio Varela, Buenos Aires, employs 116 staff and serves a large patient population across multiple medical specialties. The Medusa group listed the organization on its dark-web leak portal, claiming to have stolen the data during a ransomware incident. No exact number of affected patients has been confirmed, but the volume of material taken suggests records belonging to thousands of individuals could be involved. Available reporting describes the exposed material as internal files rather than a narrowly defined set of database tables.

Why This Matters for You and Your Family

When a hospital loses control of 761.60 GB of internal data, the information often includes names, national ID numbers, addresses, phone numbers, medical histories, insurance details, and sometimes dates of birth for you, your children, or elderly parents who received care there. Once that material reaches a ransomware leak site, it can be downloaded by identity thieves, insurance fraud operators, or harassers within hours. Medical data is especially damaging because it can be used to impersonate you when filing false claims, obtaining prescription drugs, or building a profile that makes social engineering attacks far more convincing. Your family’s privacy is directly at stake even if you never see a ransom note.

The Doxxing and Identity-Chain Implications

Ransomware leaks rarely stop at one dataset. Attackers or buyers frequently cross-reference the stolen hospital files with other breaches to link an email address found in the El Cruce material to a username on a gaming platform, a social-media handle, or a family member’s account. This creates an identity chain that can lead to doxxing, account takeovers, or targeted harassment. Credential leaks like this one routinely cascade into gaming account compromises because children often reuse simplified passwords tied to family information. The speed at which these chains form means early detection is essential.

Medusa Group’s Public Track Record

Public reporting attributes Medusa with emerging in 2021 as a ransomware-as-a-service operation. The group has previously targeted hospitals, schools, and municipal governments across multiple countries. Its typical playbook involves initial access through phishing or exploited remote-desktop services, followed by claimed exfiltration of sensitive files before encryption. Medusa then demands payment and, if unpaid, publishes samples or the full archive on its leak site to pressure victims. The exact success rate and full list of prior victims remain unclear from open sources, but healthcare organizations have appeared repeatedly on its portal.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity drawn from the Hospital El Cruce breach and thousands of others.
• Rotate any password you used at Hospital El Cruce or related Argentine health systems anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same leaked address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing day-to-day accounts.

The incident at Hospital El Cruce shows how quickly a single healthcare breach can feed larger identity chains that affect everyday families. Taking concrete steps now limits the damage and reduces the chance that your information becomes part of the next extortion campaign. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed data.