moscati.org Listed by Krybit Ransomware Group

On July 1, 2026, the website of Hôpital Catholique Saint Joseph Moscati appeared on the leak site of the ransomware group Krybit, with the attackers claiming to have exfiltrated internal files from the Catholic hospital in a ransomware incident.

What Public Reporting Shows

Public reporting indicates that Krybit posted details of the breach on its dark web leak site, accessible via an onion address. The hospital, which operates under the motto “Foi et charité,” had its internal files taken during a ransomware attack. Available reporting describes the victim as a Catholic hospital but does not specify the exact number of individuals affected. No precise count of exposed records has been released, and the full scope of the internal files remains unclear from current public information.

Why This Matters for You and Your Family

When a hospital’s internal files are stolen, the information inside often includes personal details that belong to patients, employees, and their families. Medical records, contact information, insurance data, and employment records can appear in these leaks. Once that data reaches a ransomware group’s site, it can be downloaded by anyone with access. For ordinary people, this means your health information, home address, phone number, or email could be circulating among criminals who specialize in identity theft and harassment. Your family’s privacy is directly at risk even if you were never employed by the hospital — many patients and their household members are affected when such data escapes.

The Doxxing and Identity-Chain Implications

Stolen hospital files rarely stay isolated. Attackers frequently combine them with other breaches to build detailed profiles. A phone number from one leak links to an email from another; an address ties to family members’ names and social-media handles. This creates an identity chain that can lead to doxxing, targeted scams, or account takeovers. Credential leaks like this one often cascade into gaming accounts, especially those belonging to children who reuse passwords or email addresses tied to family medical records. Once criminals map these connections, harassment or financial fraud can follow months or even years later.

Krybit’s Publicly Known Track Record

Public reporting attributes the attack to the ransomware group known as Krybit. The group emerged in recent years and has targeted organizations across multiple sectors by deploying ransomware to encrypt systems, exfiltrate data, and then demand payment to prevent publication. Their typical playbook involves initial access through common vulnerabilities or phishing, followed by data theft and extortion via leak sites if the victim does not pay. Notable prior victims have included various companies and institutions, though specific details remain limited in open sources. Readers can follow trackers that monitor Krybit’s activity for updates on their operations.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at the hospital or related services anywhere it has been reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles for you while you focus on securing daily life.

The incident shows that medical organizations remain attractive targets and that data stolen today can fuel identity crimes long after the initial breach is announced. Protecting yourself and your family requires both immediate password hygiene and ongoing visibility into how your information travels across the internet. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this kind of leak creates.