Argentina: AI attack hit 15 health centers

CrowdStrike attributed an AI-driven campaign to at least 15 Argentine health organizations. In at least one victim, available reporting says credentials and medical records were documented as being taken. The case was presented as an intrusion limited to what the sources confirmed, not as a ransomware campaign.

What is known about the campaign?

CrowdStrike described four actors that ran AI-enabled campaigns between May and August 2026, and one of those operations targeted health entities in Argentina. According to Becker's Hospital Review, the campaign against Argentine organizations was attributed to a bilingual operator in Spanish and English. TokenPost separately reported that at least 15 organizations were affected.

What happened inside one of the victims?

In one case, access to credentials on a central authentication server was reportedly obtained in about 20 minutes, according to El Mediático. IT Brief Australia added that the agent established a reverse shell to an external command and control server, accessed a domain controller, and collected five password hashes. That sequence points to internal movement within the intrusion, but the sources do not extend that detail to all affected entities.

What scope does the confirmed exfiltration have?

The confirmed exfiltration does not cover all 15 entities, according to the additional coverage cited by TokenPost. That outlet distinguishes between at least 15 compromised organizations and documented extraction of credentials and medical records from at least one victim. In other words, the available material supports a confirmed theft in one case, but not verified exfiltration across the full set of institutions.

What limits does the available information have?

The sources gathered here make it possible to reconstruct the overall attribution, some technical steps, and the minimum scope of the intrusion, but they do not provide evidence to describe it as a encryption or extortion campaign. Nor is there any basis in the material provided to extend the finding of extracted medical records or credentials to every organization involved.