The Ulose ransomware-extortion group has listed newyjh.com, a private Korean hospital, on its leak site. According to the listing, which appeared on September 29, 2026, the group claims to have obtained data belonging to the hospital’s customers. Newyjh.com has not publicly confirmed the claim as of writing, and no independent regulator or breach database has verified the claim.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch newyjh.com
Get alerted the next time newyjh.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about newyjh.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
This means the only information currently available is an unverified accusation from the extortion group itself. The record does not enumerate any specific categories of information, does not state how many people may be affected, and does not provide an incident date separate from the filing date. As a result, it is not possible to determine whether any data was taken, what that data might have been, or whether the claim is accurate, recycled, or fabricated to apply pressure.
What a Leak-Site Listing Actually Establishes
Ransomware groups frequently publish names of healthcare organisations on leak sites as part of their extortion playbook. The goal is usually to create public pressure so the target pays to prevent publication or further leaks. In the majority of such cases the listing remains unconfirmed by the organisation, by data-protection authorities, or by any third-party breach index. The appearance of a name on one of these sites does not, by itself, prove that a breach occurred, that customer records were allegedly stolen, or that any particular information is now public.
Real confirmation would require an official statement from the hospital, a regulatory filing that clearly identifies the incident, or forensic evidence made public by an independent party. Until one of those appears, the safest approach is to treat the listing as an allegation rather than established fact. This uncertainty is common in ransomware-extortion claims against healthcare providers and does not itself indicate whether newyjh.com experienced an incident.