On September 27, 2024, Argentine healthcare provider OMINT appeared on the leak site of the safepay ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, which reported $540.7 million in revenue, has not yet published a formal breach notification quantifying the number of affected individuals or detailing the exact records involved.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Omint
Get alerted the next time Omint files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Omint’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Primary Disclosure Details
The safepay leak site entry states that OMINT suffered a ransomware incident in which attackers successfully exfiltrated internal files. No specific volume of records is listed, nor does the posting enumerate the categories of data taken. The disclosure simply states that the files are now held by the group and implies they will be released or used for extortion if demands are not met. Public copies of the listing, mirrored on ransomware.live at https://www.ransomware.live/id/T01JTlRAc2FmZXBheQ==, contain no additional technical indicators such as sample documents or screenshots of the stolen material.
Why This Matters for You and Your Family
When a healthcare organization like OMINT is breached, the information at risk often includes personal details that directly affect patients and their families. Even though the exact data types remain undisclosed, ransomware operators routinely target patient records, insurance information, billing data, and internal correspondence that can contain names, addresses, dates of birth, and national identification numbers. Exposure of such material increases the chance that you or a family member could face identity theft, fraudulent insurance claims, or targeted phishing campaigns that reference real medical history. Because healthcare data retains value on the criminal market far longer than simple login credentials, the risk does not disappear when the initial news cycle ends.
Doxxing and Identity-Chain Risks
Stolen internal files frequently contain more than isolated records; they can include spreadsheets that link customer identifiers to email addresses, phone numbers, and sometimes employee notes. Attackers and subsequent data brokers can chain these fragments together with information from other breaches to build detailed profiles. A single leaked policy number or medical claim reference can be correlated with your username on a patient portal, your child’s school email, or a family member’s gaming account. Once these connections surface on underground forums, the pathway to full doxxing—public exposure of home address, relatives’ names, and financial details—becomes straightforward. Credential leaks of this nature also cascade into account takeovers across unrelated services that reuse the same passwords.