On November 6, 2025, the Provincial Department of Health Services Sri Lanka appeared on the leak site of the ransomware group known as Kryptos. The listing includes internal files exfiltrated during a ransomware attack that struck a network responsible for 145 institutions, 439 field clinic centres, and oversight of 850 medical officers.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
What Public Reporting Shows
Public reporting indicates the department’s data was stolen and later published on the Kryptos leak portal. The exposed material consists of internal files; the precise number of records and the full list of data types remain unclear. No confirmed count of affected individuals has been released. The incident follows the group’s typical pattern of encrypting systems, exfiltrating selected documents, and then posting samples as proof when ransom demands go unmet.
Why This Matters for You and Your Family
When health-service networks are breached, the information stolen often includes names, addresses, national identification numbers, medical histories, and contact details of ordinary citizens who used public clinics, maternal-health programmes, or routine check-ups. If your family has received care through any of Sri Lanka’s provincial health institutions in recent years, your records may now sit in an attacker’s archive. Medical data is especially sensitive because it can be used for identity theft, insurance fraud, blackmail, or to build detailed profiles that make further scams more convincing. Once such information leaves official systems, it circulates for years on underground markets.
The Doxxing and Identity-Chain Implications
Health-department files frequently link personal identifiers to family members, home addresses, phone numbers, and sometimes children’s records. Attackers do not stop at the initial leak. They combine the newly obtained data with credentials from earlier breaches to create long identity chains. A leaked clinic visit record can reveal an email address; that email can unlock a gaming account; the gaming account often contains chat logs, payment methods, and further personal details. The result is a cascading exposure that reaches far beyond the original health file. Credential leaks like this one cascade into account takeovers and doxxing chains, which is why continuous monitoring matters.