hospitalescultural.com.br Listed by qiulong Ransomware Group

On April 26, 2024, Brazilian plastic surgery clinic Hospital Escultural appeared on the leak site operated by the qiulong ransomware group. The listing states that the attackers exfiltrated 50 GB of internal files during a ransomware incident. The clinic, led by Dr. Eder Damacena and Dr. Eisenhower Damascena, specializes in surgical and non-surgical cosmetic procedures. The disclosure does not specify which exact records were taken or how many patients and staff may be affected.

Details from the Leak Site

The qiulong leak site listing states that Hospital Escultural suffered a ransomware attack in which internal files were exfiltrated. It lists the data volume as 50 GB and provides contact details for the clinic including its business email and Brazilian phone number. The notification does not quantify the number of affected records, nor does it describe the precise categories of data beyond “internal files.” Public views of the leak site show sample files but do not reveal full patient lists or financial databases in the publicly indexed portion.

The clinic’s own description emphasizes personalized cosmetic care, which implies the stolen material likely includes sensitive medical documentation, photographs, consent forms, and administrative records that routinely accompany plastic surgery practices.

Why This Matters for You and Your Family

When a medical provider like Hospital Escultural is breached, the people most exposed are patients whose names, contact information, dates of birth, national ID numbers, medical histories, and procedure photographs may have been taken. Even if the exact number of records remains unknown, any patient treated there since the clinic opened faces the possibility that their private health decisions may now be in the hands of criminals.

Medical data carries lifelong sensitivity. A leaked plastic surgery record can be used for blackmail, insurance fraud, identity theft, or public shaming. Families are affected because spouses, children listed as emergency contacts, or shared insurance policies can be pulled into the same identity web. The breach therefore creates risk that extends beyond the individual patient to the entire household.

Doxxing and Identity-Chain Risks

Stolen internal files from a cosmetic clinic often contain more than clinical notes. They commonly include patient intake forms with home addresses, phone numbers, email accounts, government IDs, and sometimes photographs that can be reverse-searched. Once attackers link an email address or phone number to real-world identity, they can follow the chain into social media, online shopping accounts, and children’s gaming profiles that reuse the same credentials.

Credential leaks like this one cascade into account takeovers. A password obtained from a hospital portal can unlock personal email, which then reveals banking details or children’s Roblox, Fortnite, or Minecraft logins. Doxxers systematically map these connections, turning one breach into a full household profile that can be sold or used for targeted extortion. Gaming accounts belonging to children are especially vulnerable because they frequently share the family address and payment methods listed in the parent’s medical file.

qiulong Ransomware Group Track Record

Public reporting attributes the qiulong ransomware group with operations that began appearing in late 2023. The group is known for targeting mid-sized organizations across Latin America and Europe, with a focus on healthcare, legal, and manufacturing sectors. Notable prior victims listed on their leak site include other medical clinics and professional service firms where patient or client confidentiality was central.

Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of internal documents before encryption. They then publish samples on their dark-web leak site and demand payment to prevent full release. The group’s extortion style combines data publication pressure with direct contact to victims, a pattern consistent with the April 26, 2024 listing of Hospital Escultural.

What to do

• Run a DoxxScan to map every link between your email, phone, government ID, and real identity so you can see exactly what chains back to the Hospital Escultural breach.
• Rotate any password you used at hospitalescultural.com.br or associated patient portals anywhere it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure that touches you or your family is caught and acted on in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains when medical files are stolen.
• Let remediation specialists handle data-broker takedown requests and opt-out processes for you so personal details tied to the breach stop circulating on people-search sites.

The Hospital Escultural breach is a reminder that healthcare providers of any size can become targets, and the data they hold travels far beyond the operating room. Acting quickly on the exposure can limit how far criminals push the stolen information. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-based attacks.