LATAM Ransomware Targets Health

Flare found that Kazu, a ransomware and extortion gang that emerged in mid-2025, has moved from focusing mainly on government and public sector victims to posting new cases tied to health care in Latin America, after an initial attack against an Italian telemedicine provider. At the same time, Pulse and other reports place claims from Qilin, Deadlock, TheGentlemen, Incransom, Akira, MedusaLocker, DragonForce and Play in Brazil, Mexico and Costa Rica, with reported impacts also involving Ecopetrol and organizations in Colombia and Mexico.

Which sectors appear most exposed in the region?

Flare's analysis shows government remains the main victim category attributed to Kazu, while health care ranks second among the most affected verticals. The research was based on 848 records gathered from ransomware sites, hacker forums and messaging platforms.

That focus on health care also appears in the ESET Security Report 2026, based on surveys of 1,563 professionals at 962 organizations across 10 Latin American countries. The report says 52.7% of companies suffered at least one cyberattack attempt in the past 12 months, and that malware infection, which includes ransomware, hits health care especially hard, with 52.9% of organizations in that sector reporting incidents through that route.

What tactics are being repeated in the region?

Alongside the pressure on health care, researchers are seeing techniques that they say are becoming more visible in the region. Experts warned about ransomware attacks on organizations in Colombia and Mexico in which attackers used the victims' corporate printers to print ransom notes after encrypting systems with BitLocker. TrendTIC described that behavior as a growing tactic in Latin America, although it did not publicly attribute those cases to a specific group.

Pulse's Ransomware Wing panel also places Brazil and Mexico among the countries with the highest number of victims claimed by ransomware groups. In Latin America, the most affected sectors include business services, health care, manufacturing, technology, consumer services, agriculture and the public sector.

Which groups and claims remain under watch?

Devel Group reported on July 22, 2026, a Qilin post in which the group claimed an alleged extortion attack against a professional services company in Costa Rica, under a ransomware-as-a-service and double-extortion model. The incident remains unconfirmed by the victim.

Pulse also records claims linked to groups such as Deadlock, TheGentlemen, Qilin, Incransom, Akira, MedusaLocker, DragonForce and Play in Brazil and Mexico, although its database draws from leak sites and does not always mean each incident has been independently verified.

In parallel, Kaseya and regional media reported that Ecopetrol, Colombia's largest oil company, confirmed a ransomware attack that led to the leak of data from 3,300 user accounts. In that case, attackers did not encrypt systems or disrupt operations, so the extortion relied on stolen information rather than a direct hit to business continuity.