Ibermutuamur Listed by Hunters Ransomware Group

On October 5, 2024, Spanish mutual insurance provider Ibermutuamur appeared on the leak site operated by the Hunters ransomware group. The listing states that internal files were exfiltrated during a ransomware incident; the company’s data was encrypted but the notification confirms exfiltration occurred. The exact number of people affected and the full scope of records remain undisclosed in the primary listing.

Reported Details from the Leak Site

The Hunters leak page for Ibermutuamur, accessible via the .onion address indexed by ransomware.live, explicitly lists the Spanish organization and asserts that data was exfiltrated. It notes that files were taken prior to any encryption of systems. The disclosure does not quantify the volume or types of internal files, nor does it specify whether customer records, employee personal data, or claims information were included. No ransom demand figure or payment deadline is published on the page. The incident is dated in the listing as occurring in 2024, with the public posting arriving on October 5.

Why This Matters for You and Your Family

When a healthcare-adjacent insurer like Ibermutuamur suffers a breach, the exposure often reaches policyholders, employees, and their dependents across Spain. Even without an exact victim count, the internal files taken can contain names, national identification numbers, addresses, medical-related billing codes, and banking details used for direct debits. If your family holds a policy through Ibermutuamur or you work with an employer insured by them, your personal information may now sit in an attacker-controlled archive. This creates immediate risk of fraud, phishing campaigns tailored with real policy data, and long-term identity theft that can affect credit scores, tax filings, and employment background checks for years.

Any leaked policy or employee file becomes raw material for criminals who combine it with other breaches to build convincing profiles. Ordinary families rarely realize their data has moved until fraudulent loans appear or unexpected medical bills arrive in someone else’s name.

Doxxing and Identity-Chain Risks

Exfiltrated internal files frequently contain email addresses, phone numbers, and occasional spouse or child references that link corporate identities to personal ones. Attackers routinely feed these into doxxing chains: an email from the breach is tested across gaming platforms, social media, and shopping accounts. A single reused password can hand over a Steam, PlayStation Network, or Roblox account belonging to you or your children. Once those gaming profiles are hijacked, the usernames, linked phone numbers, and chat histories are sold onward, extending the exposure far beyond the original insurance breach. The result is a cascading identity trail that can expose home addresses, children’s names and ages, and even geolocation data extracted from connected devices.

Hunters Ransomware Group Track Record

Public reporting attributes the emergence of Hunters to late 2023. The group has since listed dozens of organizations, focusing on mid-sized European companies in healthcare, manufacturing, and insurance sectors. Notable prior victims include several European healthcare providers and logistics firms, though exact details remain limited in open sources. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of internal shares before deploying ransomware. Hunters favor double-extortion: they threaten both encryption and public release of stolen files. The group’s leak site is used both to pressure victims and to advertise data to other criminals. While some ransomware operations negotiate quietly, Hunters have shown willingness to publish samples when payments are not received.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you have reused at Ibermutuamur or related insurer portals and switch to 2FA using an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same breached address or email.
• Let remediation specialists manage takedown requests for any exposed personal documents or broker listings that surface from this incident.

The Ibermutuamur listing is a reminder that even established insurers remain targets and that yesterday’s corporate breach can become tomorrow’s family headache. Starting proactive defense now limits how far attackers can travel along your identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk of takeover from credential leaks like this one.