INCAN restores radiotherapy after cyberattack

The Cancer Hospital (INCAN) said its radiotherapy services were fully restored and have operated normally since Sept. 11, after a cybersecurity incident temporarily affected the institution's systems. Coverage of the case said the Radiotherapy Department was the area affected during the event.

What did INCAN confirm?

INCAN confirmed that a cybersecurity incident occurred and that the Radiotherapy Department was temporarily affected. The institution did not release additional technical details in the available coverage about the scope of the event or the type of disruption its systems suffered.

The key point is that operations have already returned to normal. According to information published by La Hora, full restoration of radiotherapy has been in place since Sept. 11. That places the incident as a case that is now operationally closed, at least for that service.

What other reference appears about a possible health care case in Mexico?

[Breach House](https://www.breach.house/country/MX) listed laconcepcion.com.mx as a victim associated with SafePay and linked it, without official confirmation, to a possible private health care provider in Coahuila. That attribution should not be read as independent confirmation, but as a lead reported by a victim tracker.

The mention appears in its Mexico listing and matches another available source, DarkField / Orizon, which also identifies a private health care provider in Coahuila as a presumed victim of a SafePay ransomware attack. However, the material provided does not include official confirmation that would allow that case to be treated as closed.

How should that reference be read?

It should be read as an unverified lead, not as an established fact. The only case confirmed by a journalistic source in the material is INCAN, with its radiotherapy service already restored and operating normally since Sept. 11.

The Breach House reference remains, for now, an unconfirmed attribution. At this stage, the available material is enough to point to a possible second case in the health care sector, but not to present it as a confirmed intrusion.