Shifa Oman Listed by thegentlemen Ransomware Group

On July 21, 2025, Shifa Hospital in Muscat, Oman, appeared on the leak site of the ransomware group known as thegentlemen. The private multispecialty medical facility is claimed to have had internal files exfiltrated during a ransomware attack, exposing patient and operational records that could contain names, medical details, contact information, and other sensitive personal data belonging to anyone who has used the hospital’s services.

What's Publicly Reported from Reporting

Public reporting indicates that Shifa Hospital’s systems were compromised and that attackers successfully exfiltrated internal files before encrypting systems or demanding ransom. The hospital, which describes itself as a purpose-built facility meeting international standards, serves a wide cross-section of Omani residents and visitors. No exact victim count has been released, but any patient, employee, or vendor whose information passed through the hospital’s records is potentially affected. The data was posted to the group’s dark-web leak site, accessible only via Tor, at the onion address hosted on ransomware.live tracking infrastructure.

July 21, 2025 marks the public listing date. The exposed material consists of internal files rather than a single structured database, increasing the likelihood that unstructured documents containing personal information were included.

Why This Matters for You and Your Family

When a hospital’s records are stolen, the consequences reach far beyond the institution. Medical histories, addresses, phone numbers, national identification details, and insurance information can be used to commit identity theft, file fraudulent claims, or impersonate family members. If you or anyone in your household has ever received treatment at Shifa Hospital, your family’s private health information may now sit in an attacker’s archive. Children’s records, often linked to parental accounts, are especially vulnerable because a single breach can expose an entire household’s profile.

Once this information reaches underground markets, it rarely disappears. Buyers combine it with other leaks to build complete dossiers, making every subsequent breach more damaging.

The Doxxing and Identity-Chain Implications

Medical data leaks create powerful starting points for doxxing chains. Attackers link a patient’s name and phone number to social-media handles, children’s school accounts, gaming profiles, and family addresses. A credential found in one place can unlock email, which then reveals passwords reused on streaming services, online shopping sites, or children’s Roblox, Fortnite, or Minecraft accounts. What begins as a hospital breach can cascade into full identity takeover, harassment, or extortion targeting you or your children.

Credential leaks like this one cascade into account takeovers because people reuse the same email-password combinations across work, health, and gaming platforms. Gaming accounts belonging to children are frequent secondary targets precisely because parents often use familiar passwords and recovery emails tied to the family’s primary records.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen ransomware group with operations that emerged in late 2024. The group has listed healthcare providers, educational institutions, and mid-sized businesses in multiple countries. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files over several weeks. They then deploy ransomware to encrypt systems and later publish samples on their leak site if the victim does not pay. Extortion tactics combine data publication threats with direct pressure on executives or families, often using contact details harvested from the stolen files.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Shifa Hospital records.
• Rotate any password you ever used at Shifa Hospital or associated clinic portals anywhere it has been reused, and switch on 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts which frequently chain back to the same family address or recovery email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your family’s daily digital life.

The Shifa Hospital breach is a reminder that healthcare providers remain high-value targets and that any family’s medical records can become public without warning. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden offers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting your DoxxScan trial gives you both immediate visibility into existing exposure and ongoing protection against the next leak.