Brazil Is Latin America’s Ransomware Hotspot

ransomware.live added Global Secret Group, a Brazil-based organization in the Hospitals & Clinics sector, as a victim with the incident discovered on July 26, 2026. The listing confirms another ransomware attack against a Brazilian healthcare provider, adding to an already sustained pattern of pressure on hospitals, clinics and other parts of the health system.

Brazil under sustained pressure

Information Management reported that Brazil had become Latin America's healthcare ransomware epicenter in 2026, accounting for 51% of ransomware cases in the sector across the region. The same review placed the country among the three biggest targets globally in the segment, drawing on PwC studies and other reports cited by the outlet.

That analysis linked the growth of the problem to the spread of generative AI and chatbots without governance, medical data moving through unencrypted platforms, and basic misconfigurations in cloud services. The report suggests that a significant share of the current risk in the sector stems from operational and management failures, rather than highly sophisticated attack techniques.

More victims, higher costs

Cafe com Bytes reinforced that view, saying Brazil accounts for 51% of ransomware incidents in the healthcare sector in Latin America. The outlet also said healthcare represents 10.4% of ransomware victims in Brazil and that, in 2026, LockBit 5 and TheGentlemen led activity in the country with 13 victims each. The piece also noted that the criminal market appears fragmented, with other groups such as Incransom and CoinbaseCartel gaining ground.

On the financial side, Cafe com Bytes cited the Brazilian healthcare sector as having the highest average cost per data breach among the sectors analyzed, at R$ 11.43 million per incident, according to IBM's Cost of a Data Breach report. In the same article, the average cost of a data breach in Brazil was put at R$ 7.19 million, up 6.5% year over year.

Attack volumes were already high

SINDPD provided broader context, saying Brazilian healthcare institutions suffered an average of 3,167 attacks per week in 2025, about 37% above the global sector average. It also said healthcare leads the global ranking of cyberattacks ahead of finance and consumer industries.

According to that same study, the first half of 2025 saw more than 11,000 security breaches in Brazil's healthcare sector, most of them successful and a significant share classified as high severity. The picture drawn by those figures is one of a wide attack surface, where ransomware operates alongside a heavy flow of intrusions and breaches.

G1 added another measure of the threat landscape in Brazil, reporting, using Fortinet data, 753.8 billion attempted digital attacks in 2025 and more than 187 million malware occurrences. In that environment, attacks against hospitals, clinics and health system providers find terrain already under pressure from multiple vectors.

Regulatory frame and key actors

Information Management also added a regulatory angle, noting that Law No. 15,352/2026 turned the ANPD into a special-purpose autonomous agency with expanded oversight powers over sensitive data, including health data. In addition, CFM Resolution No. 2,454/2026 established Brazil's first framework for the use of artificial intelligence in medicine, effective in August, in response to the rise in incidents and the risk of AI use without governance in the sector.

At the same time, Flare.io identified TheGentlemen among the groups targeting healthcare organizations and providers across the health ecosystem. That analysis, focused on EMEA, described a dynamic that reaches the full healthcare supply chain, including software vendors, clinics, labs and hospitals, and monetizes leaked data through leak sites and secondary fraud. The pattern matches the pressure seen in Brazil on providers such as MedicSolution and private clinics.