https://seha.org.sa Listed by tengu Ransomware Group

On January 14, 2026, the tengu Ransomware Group listed the Health Services Association in Saudi Arabia’s Qassim region on its leak site, claiming to have exfiltrated internal files from https://seha.org.sa.

Reported Details of the Incident

Public reporting indicates the organization, a non-profit providing health and social services, had data taken during a ransomware attack. The tengu group posted evidence on its dark-web blog, accessible via the .onion link tracked by ransomware.live. Exact victim numbers remain unknown, and the precise volume or types of internal files have not been independently verified beyond the group’s claims. No public confirmation has yet come directly from the Health Services Association itself.

Why This Matters for You and Your Family

When health-related non-profits suffer breaches, the information involved often includes personal details of patients, donors, volunteers, or staff. If you or anyone in your family has received assistance from organizations like this, your records could be among those now in attackers’ hands. Health and social service data is especially sensitive because it can reveal medical conditions, financial hardship, home addresses, and family relationships. Once exposed, such details do not expire; they can be reused for years in fraud, identity theft, or harassment schemes that eventually reach your household.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one database. A single exposed email, phone number, or internal note can be fed into automated tools that link it to your social-media handles, children’s accounts, and other services. This creates an identity chain that turns a distant organizational breach into direct targeting of you and your family. Credential leaks like this one frequently cascade into account takeovers on gaming platforms, where children’s usernames and shared family passwords become entry points for further doxxing. What begins as “just internal files” can quietly surface months later on forums used by stalkers or scammers.

Tengu Ransomware Group’s Known Activity

Public reporting attributes the group’s emergence to 2024. It has since claimed responsibility for attacks on healthcare providers, educational institutions, and smaller government-linked entities. Typical playbook involves initial access through phishing or unpatched remote desktop services, followed by exfiltration of documents before encryption. The group then demands payment and, if unmet, publishes samples or full datasets on its leak site with countdown timers. Exact success rate and prior Saudi victims are not fully documented in open sources, but the pattern of targeting mid-sized health and charitable organizations is consistent across available reports.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach may have exposed.
• Rotate any password you used on seha.org.sa or related health-service portals anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses or shared credentials revealed in incidents like this.
• Let remediation specialists handle the follow-up work, including takedown requests on any data-broker or forum listings that surface from the tengu leak.

The incident is a reminder that even charitable health organizations holding ordinary families’ information remain attractive targets. Taking concrete steps now limits how far this claimed breach can follow you. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage includes children’s gaming accounts that frequently become the next link in doxxing chains after credential leaks of this kind.