ANPD investigates ISAC after data leak

Brazil’s National Data Protection Authority (ANPD) has opened an administrative enforcement case against the Instituto de Saúde e Cidadania (ISAC) after a security incident involving patients’ personal data and sensitive data.

According to O Globo’s coverage, the regulator is seeking to examine failures in protecting sensitive information tied to nearly 500,000 patients. The outlet also said ISAC will have 10 business days to mount a defense, and that possible penalties range from a warning and a fine of up to 2% of revenue to the suspension or ban of personal data processing.

The case drew broader attention after Brazilian press reports pointed to a ransomware attack against ISAC in July 2026. TI Inside said that episode led to a data leak involving patients linked to the institute, and described the affected volume as close to 500,000 people, while noting that the figure is approximate.

ANPD itself, in an institutional post on social media cited by CNN Brasil, described the episode as a ransomware cyberattack that affected approximately 500,000 patient records and prompted the opening of the sanctioning process against ISAC.

CyberSec Brazil also linked the incident to a hacker attack scenario and said the authority opened the case after the exposure of data from about 500,000 patients. Legismap, meanwhile, summarized the ANPD’s review as focused on failures in the protection of sensitive personal data and possible shortcomings in victim notification and in the security measures adopted before and after the incident.

GaúchaZH added that ISAC itself reported an impact of about 500,000 records, including 78,772 children and teenagers and 47,921 elderly people, widening the incident’s reach among vulnerable groups.