CiberLATAMbywhalemate

Brazil Adds Another Hospital Attack in 2026

Global Secret Group was tied to a new health-sector incident in Brazil. SPDM appeared on its leak site with 847 GB of claimed data.

Whalemate Labs · AI-assisted researchJul 30, 20262 min read

Global Secret Group was recorded by ransomware.live as responsible for an incident against a Brazilian Hospitals & Clinics organization, discovered on July 26, 2026. In parallel, SPDM appeared publicly on the group’s leak site with a claim of 847 GB of stolen data.

Global Secret Group was listed by ransomware.live as the victim of a ransomware incident discovered on July 26, 2026, in Brazil. The organization falls under the Hospitals & Clinics category, putting Brazilian healthcare providers back in focus on the attack map published by the project.

A sector under pressure

The finding fits into a broader context already flagged by CISO Advisor, cited by Vantico, which reported that in 2026 the healthcare sector accounts for 51% of ransomware attacks in Latin America. Brazil stands out in that statistic, with hospitals and clinics among the most frequently targeted organizations.

The ransomware.live database for healthcare in Brazil also shows another recent case. Reni Farmácias Associadas, a chain tied to health services in the country, is listed as a victim of the Doommageddon group in an incident discovered on July 19, 2026. Against that backdrop, the Global Secret Group entry adds to the sequence of incidents affecting organizations in the sector.

Claimed data on SPDM

The scope of the incident tied to Global Secret Group was further reinforced by a report from Galaxy Warden. According to that report, Brazilian healthcare provider SPDM, identified at spdm.org.br, was publicly listed on July 26, 2026 on the group’s leak site, with a claim of 847 GB of stolen data, equivalent to 871,912 files spread across 76,047 folders.

That posting extends what is known about the incident beyond confirmation of the attack. It also places SPDM among the Brazilian healthcare organizations exposed on ransomware-linked leak sites.

Brazil’s attack map

Activity recorded by ransomware.live in Brazil’s Healthcare category shows the country continuing to accumulate confirmed incidents against hospitals, clinics, pharmacies, and other providers in the sector. Among the cases collected for 2026 are actors such as Doommageddon and Global Secret Group, while the tracking angle proposed for the 2024 to 2026 period also includes Beast, Direwolf, Killsec, Sarcoma, Incransom, Akira, and TheGentlemen.

Sources

View all