Institut Mensalus S.L. Listed by 8base Ransomware Group

On July 25, 2023, Institut Mensalus S.L., a Barcelona-based psychology, psychiatry, and neuropsychology clinic, was listed on the leak site of the 8base ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The number of affected individuals remains unknown, and the precise volume or categories of records taken have not been publicly quantified by the clinic or the threat actors.

Details in the 8base Listing

The primary disclosure on the 8base leak site indicates that Institut Mensalus suffered a ransomware incident in which attackers successfully exfiltrated internal files before encrypting systems. No specific patient count, employee count, or detailed inventory of stolen data appears in the listing. The clinic’s own description confirms it maintains records tied to more than 30 years of multidisciplinary mental-health services, including individualized treatment plans, psychiatric assessments, neuropsychology evaluations, educational psychology reports, and speech-therapy documentation. Because the disclosure does not itemize the files, the exact sensitivity and scope of the exposed material cannot be confirmed from public information.

Why This Matters for You and Your Family

When a mental-health provider is breached, the stakes are intensely personal. Records may contain names, contact details, dates of birth, insurance information, diagnoses, session notes, and family histories. Even without an exact victim count, any individual or family who has received care at Institut Mensalus since the center opened faces the possibility that their most private health information may now be in the hands of criminals. Health data of this nature is difficult to change and can be used for identity theft, insurance fraud, blackmail, or targeted social-engineering attacks. Children and adolescents treated for educational or developmental issues are especially vulnerable because their records often link directly to parental identities and home addresses.

Doxxing and Identity-Chain Risks

Exfiltrated internal files frequently include spreadsheets or databases that cross-reference patient names with email addresses, phone numbers, insurance IDs, and sometimes employer or school details. Once such information reaches underground forums or ransomware leak sites, it can seed larger doxxing chains. A single leaked email can be correlated with gaming usernames, social-media handles, and family-member profiles. Public reporting on similar incidents shows that mental-health data is prized precisely because it offers deep personal leverage. The combination of clinical notes and contact information creates a roadmap for stalkers, fraudulent creditors, or opportunistic extortionists who may later demand payment to suppress release of sensitive therapy details.

8base Ransomware Group Track Record

Public reporting attributes the emergence of 8base to mid-2022. The group operates a ransomware-as-a-service model and has claimed responsibility for attacks on hundreds of organizations across multiple countries. Notable prior victims include mid-sized healthcare providers, manufacturers, and professional-services firms. Their typical playbook involves initial access through compromised remote-desktop credentials or exploited vulnerabilities in common business software, followed by rapid exfiltration of documents before deployment of ransomware. 8base usually posts a sample of stolen files on their leak site and sets a short deadline for payment before releasing the full archive. In many cases the group does not engage in prolonged negotiation once data is published.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you ever used at Institut Mensalus wherever it has been reused, and switch on 2FA through an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same address or parental email.
• Let remediation specialists handle takedown requests across data-broker sites and underground forums where your information may already be circulating.

The breach of Institut Mensalus illustrates how quickly sensitive health data can move from a trusted clinic into criminal hands, often with little warning to the people whose lives are documented in those files. A forward-looking approach means treating every new breach as a prompt to lock down the connections that criminals exploit. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that links online handles to real-world identities, and hands-on remediation by specialists; its household coverage also protects gaming accounts belonging to you or your children that can otherwise become entry points for further compromise. Start your DoxxScan trial today and close the gaps before the next leak appears.