Chile and Guatemala Hospitals Hit by Ransomware

Update September 8, 2026: new platforms linked the INCAN case in Guatemala to the Krybit group and identified ligacancerguate.org and incan.org.gt as victims. In Chile, there were no relevant public changes, and Hospital Clínico Universidad de Chile still appears in leak-site listings attributed to Direwolf.

Direwolf has now been tied to two separate health care institutions in Latin America. In Chile, several monitoring and analysis platforms reported that the group had listed Hospital Clínico Universidad de Chile on its leak site, along with an alleged 240 GB data theft. In Guatemala, the National Cancer Institute, INCAN, ultimately acknowledged an incident that affected its Radiotherapy Department and temporarily disrupted key services for cancer patients.

What happened to Hospital Clínico Universidad de Chile?

Direwolf published the hospital on its leak site, but by the time of publication there was no official public confirmation from the institution or regulators about the incident. MedRisk.io said the case appeared at the same time as a Turkish hospital case, with a discovery date of August 30, 2026 in RansomLook and Ransomware.live, while GalaxyWarden said the group claimed to have stolen internal data without specifying how many people may have been affected or what categories of information were compromised.

HookPhish attributed the attack on Hospital Clínico Universidad de Chile and dated it technically to August 30, 2026, with target domain redclinica.cl, health sector, and Chile as the region, though it offered no independent evidence beyond the leak-site listings. Ransom-DB placed the center in Independencia, Santiago, and described it as a public university hospital and the main teaching and clinical center of the University of Chile School of Medicine. Hackmanac, meanwhile, said Direwolf claimed to have compromised medical records, customer data, clinical logs from 2023 to 2026, biopsy files, patient documents, GES admission records, master records, and medical histories, and marked the case as "Pending verification" even while attributing an exposure of 240 GB.

Security Arsenal added that its dark web monitoring confirmed the Hospital Clínico Universidad de Chile listing among three new Direwolf victims in a 24-hour window, with two hospitals among those targets. Dexpose also said Direwolf claimed to have attacked the hospital and warned of a possible data leak if no negotiation took place. TweetThreatNews reported disrupted hospital operations and encrypted data, but without official support or technical detail.

What did INCAN confirm in Guatemala?

The National Cancer Institute, INCAN, acknowledged that its Radiotherapy Department was breached in a cybersecurity incident that temporarily affected its services. The official statement came after questions from La Hora, which had cited internal sources about system outages and a loss of access to prior MRI records, affecting patient follow-up.

La Hora also reported that the attack encrypted the system used to plan radiotherapy and temporarily affected about 194 patients. Later, the National League Against Cancer, the entity responsible for INCAN, said the case was under investigation by the relevant authorities and that administrative, medical, physics, and technical teams were working to restore care while prioritizing patient safety.

Infobae later expanded the scope and said the incident cut off temporary access to the system holding radiotherapy treatment plans, doses, and clinical images, affected 194 cancer patients, and forced the suspension of radiotherapy, brachytherapy, and superficial radiotherapy. The same report said the linear accelerators were not compromised and that in-person medical consultations continued.

Tracking platforms then began linking the case to Krybit. Ransomware.live lists ligacancerguate.org as a victim of the group and sets September 3, 2026 as the estimated attack date, with an explicit reference to INCAN. Dexpose.io also attributes the incident to Krybit and says the gang claimed responsibility, threatened to publish sensitive data if its demands were not met, and pointed to the ligacancerguate.org domain.

Hookphish documented the episode as Krybit ransomware against ligacancerguate.org, with breach and discovery dates of September 3, 2026, while Ransomnews added ligacancerguate.org and incan.org.gt to Krybit’s recent victims linked to INCAN. At the same time, the National League Against Cancer’s initial public communication continued to describe the incident as a cybersecurity event that breached Radiotherapy, without using the term ransomware at first.