Instituto Nacional de Oftalmologia, Peru Listed by NightSpire Ransomware Group

On November 9, 2025, the Instituto Nacional de Oftalmologia in Peru appeared on the leak site of the nightspire ransomware group. Public reporting indicates the attackers exfiltrated internal files during a ransomware incident. While the exact number of affected individuals remains unknown, anyone whose medical records, personal details, or family information passed through the institute could now face heightened risks of identity theft and doxxing.

What Public Reporting Shows

Available reporting describes a ransomware attack in which nightspire gained access to the Peruvian national ophthalmology institute’s systems and removed internal files. The group published a listing on its leak site on November 9, 2025, a common tactic used to pressure victims. No precise count of exposed records has been released, and the specific types of data have not been publicly detailed beyond the broad category of internal files. The institute has not yet issued a public statement confirming the breach or notifying patients.

Why This Matters for You and Your Family

Medical institutions hold some of the most sensitive information about you and your loved ones: names, addresses, dates of birth, national ID numbers, insurance details, diagnoses, and treatment histories. When that information leaks, it becomes raw material for fraud, identity theft, and targeted scams. Medical data sells for high prices on underground markets precisely because it is difficult to change and can be used to impersonate you at banks, government agencies, or insurers. For families, a single breach can expose children’s records alongside parents’, creating long-term risks that stretch across generations.

The Doxxing and Identity-Chain Implications

Stolen internal files often contain more than isolated records. They can include email lists, staff directories, patient contact sheets, and notes that link names to usernames, phone numbers, or even children’s school or gaming details. Attackers and opportunistic criminals then follow these links to build an identity chain — moving from one compromised account to the next. A leaked email from a hospital visit can unlock a reused password on a gaming platform, which in turn reveals an address or family photos. This cascading exposure turns a single institutional breach into a personal doxxing risk that can affect every member of your household.

Nightspire’s Publicly Known Track Record

Public reporting attributes nightspire with emerging in early 2025 as a ransomware operation that combines encryption of victim systems with data exfiltration. The group has listed healthcare providers, government agencies, and smaller enterprises. Its typical playbook involves initial access through phishing or unpatched remote desktop services, followed by lateral movement inside the network, exfiltration of sensitive files, and deployment of ransomware. After encryption, the group posts samples or announcements on its leak site and demands payment to prevent full data release. Observers note that nightspire follows the double-extortion model now common among ransomware actors.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you used at the Instituto Nacional de Oftalmologia or related Peruvian health services, and switch on 2FA through an authenticator app everywhere that password was reused.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points in doxxing chains after credential leaks like this one.
• Let remediation specialists handle takedown requests across data brokers and exposed records so you do not have to chase every site yourself.

The incident at Peru’s national ophthalmology institute shows how quickly institutional data can become personal exposure. Taking deliberate steps now limits how far attackers can travel down the identity chain that begins with this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes your children’s gaming accounts. Start your DoxxScan trial today to regain control of what attackers already have.