Health, Clinics, Hospitals, and Pharma, Aug 2026

Monthly reference modules

These modules are populated automatically with verified dated events within the period. Each one states its source and counting criterion so the figures can be reconciled across modules. They are the recurring month-by-month readout, and the analysis that follows develops the cases without repeating this summary.

Indicator window: 90 dated events in August 2026. Events from earlier months are used only as comparative context in the analysis, never as part of this period's total.

Executive Summary

August 2026 painted a mixed picture for health systems, clinics, hospitals, and pharmaceutical companies across Latin America. On one side, a string of financial fraud incidents and data exposure cases involving healthcare providers and public surveillance systems became more established. On the other, new ransomware claims against hospitals and health platforms appeared in several countries, though with varying levels of public confirmation. The month was not defined by a single threat family. Instead, three patterns coexisted, ransomware extortion with leak site publications, banking fraud or online scams affecting health institutions, and disclosures of exposed databases without authentication that revealed regulatory and patient information.

The clearest and best documented signal of the period was the exposed SISVISA database in Brazil, which left 102,215 records and approximately 79 GB of related material accessible on health surveillance and licensing. Jeremiah Fowler's investigation showed that this was not an isolated file, but a set containing identifiers, tax data, regulatory documents, licensing requests, authorizations, inspection reports, compliance documentation, citizen complaints, and compressed backups. Although public access was disabled shortly after responsible disclosure, the actual exposure window could not be determined, and there is no public official confirmation on the full scope or any possible third-party access. For a healthcare CISO, the case is especially relevant because it shows how a poorly configured regulatory environment can become an exposure vector as sensitive as a clinical breach, with operational, reputational, and compliance consequences.

In parallel, EsSalud Lambayeque in Peru became one of the clearest examples of financial fraud enabled by remote access and technical impersonation. Media coverage converges on the finding that individuals posing as Scotiabank support gained remote access to the institution's devices through usernames and passwords provided by network staff, and from there carried out five unauthorized transfers totaling S/ 1.406.991. The case also led to a procedural turn, prosecutors ruled it was not only an external scam and opened an investigation into alleged embezzlement against four EsSalud officials, saying the money transfer appears to have involved direct participation from those responsible for the account. That distinction matters because it separates a simple technical deception from an internal controls failure, a combination that raises severity and requires reviews of not only cybersecurity, but also segregation of duties, out-of-band validation, and payment governance.

Brazil and Chile also saw notable incidents in the form of ransomware claims. In Brazil, Mobilemed appeared in monitoring lists as a presumed victim of the Kazu group, with an alleged exfiltration of 23.5 TB and a ransom estimated at US$ 1.5 million, although the company did not publicly confirm the scope. The analytical value of the case lies less in the figure, which comes from aggregators and the leak site, and more in the recurring pattern. Kazu continued to aim its posts at healthcare and at providers in the health supply chain, not only clinics or hospitals, but PACS platforms, telemedicine, practice management services, and other software critical to care delivery. In that same vein, Centro Médico Especializado OSI: Healthcare Solutions in Peru was listed by Kazu as a presumed victim, also without public confirmation from the clinic by the end of the period analyzed.

Chile accounted for another of the month's most sensitive pieces with the appearance of Hospital Clínico Universidad de Chile on the extortion portal attributed to Direwolf. Precision matters here, the available sources describe a leak site claim and automated tracking, not an independent validation by the hospital, a CERT, or a regulator. Even so, the case deserves attention for two reasons. First, there was the reported detection speed from the monitoring infrastructure, which identified the case in a window of less than 20 minutes according to the timestamp shared by HookPhish. Second, there was the campaign context, third-party analysis linked Direwolf to other victims published within a 24-hour span, including organizations in healthcare and a technology company, which suggests a multivictim and multiregional offensive pattern. For a response team, the value of this kind of observation is not to determine definitive culpability, but to refine prioritization, leak site monitoring, and crisis communications planning.

August's regional picture also included signs of regulatory and operational pressure in other countries. In Paraguay, the public narrative around cyberattacks on healthcare appeared in both parliamentary statements and interviews with specialists, although with limited verifiable technical detail. The most concrete case was Sanatorio San José in Ciudad del Este, where the investigation documented two unauthorized transfers of 250 million and 100 million guaraníes, carried out as manually entered operations using the username of an employee who was not authorized to approve payments, and later returned by the bank after intervention from the Prosecutor's Office and the Cybercrime Department. Although the bank denied any breach of its systems and attributed the events to attacks aimed at deceiving users, broad coverage cemented the idea of a "hacked" account, reinforcing public concern about private healthcare providers.

From a regional standpoint, August showed a chain of dependencies that amplifies risk. Clinics depend on cloud PACS platforms, sanatoriums depend on banks and tokens, hospitals depend on health surveillance portals, and provider networks depend on remote access or legitimate support tools that can later be abused. The common denominator was not a single technical family, but the exposure of critical information and payment flows in environments where clinical users, administrative staff, and outside vendors overlap. The recommendation for CISOs is clear, segment access, strengthen out-of-band approvals, remove unmanaged remote access software, audit privileged accounts, and prepare procedures to respond to ransomware, financial fraud, and regulatory exposure alike.

Panorama

August shows that Latin American healthcare remains an attractive target, not only because of the value of clinical data, but also because of its complex attack surface: fragmented internal networks, multiple vendors, integrations with banks, licensing portals, imaging systems, and telemedicine tools. That mix means a single organization can face, at different times, exposure of sensitive data, administrative fraud, and extortion through information leaks, without all of those events sharing the same vector or the same level of impact.

From a defensive standpoint, August 2026 leaves two especially important lessons. The first is that the sector still shows weakness in basic configuration controls and public exposure. The SISVISA case did not require advanced exploitation, only an unprotected database tied to the Brazilian government’s health surveillance and licensing portal. In other words, the issue was not a zero-day vulnerability, but a failure in operational hygiene and asset management. The second lesson is that fraud schemes reaching clinics and hospitals do not always involve ransomware or direct intrusion into the organization’s core systems. The EsSalud Lambayeque case, as well as the one involving Sanatorio San José in Paraguay, relied on social engineering, remote access, and manipulation of authorization flows. That forces the cybersecurity discussion to expand into fraud, financial continuity, and accounting controls.

There is also evidence of a more mature extortion model aimed at healthcare as an ecosystem, not just as a collection of isolated hospitals. Kazu, for example, appears to be an actor that does not limit itself to care providers, but also targets cloud PACS platforms, rehabilitation software, telemedicine, clinics, and clinical management services. The criminal logic is clear, by compromising a supply-chain provider, the attacker can reach multiple customers or force higher-value negotiations, even if the direct victim is not a large hospital network. Direwolf, meanwhile, was observed posting several victims within the same time window, including hospitals and tech companies, which suggests pressure for volume and visibility on its leak site. For defenders, the message is that the risk surface extends beyond the institutional perimeter and must include third parties, SaaS, cloud storage, and support vendors.

A second recurring pattern is weak credential and session management. In EsSalud Lambayeque, the attackers reportedly used remote access and usernames and passwords provided by internal staff, in addition to impersonating legitimate support. In Paraguay, the bank involved insisted that the fraud was based on user deception and fake websites, not on a compromise of its core systems. In both scenarios, technical defense alone is not enough if authentication processes, identity validation, and payment confirmation still rely too heavily on operational trust. In healthcare, where time is short and clinical urgency can pressure staff, this kind of manipulation is especially effective.

The regulatory picture is also uneven. Brazil showed investigative detection and a quick response to remove public access, but without a strong official communication that would fully clarify how long the exposure lasted. Peru, by contrast, combined a formal complaint, legal action, and public pressure on the bank to recover the funds, but the debate ended up shifting toward the possible involvement of internal employees. Chile and Argentina moved more in the realm of leak-site monitoring and threat intelligence analysis, with less visible institutional confirmation. That disparity means regional analysts have to read each case carefully: what appears in one country as an "incident" in a ransomware feed may be, in another, only an unverified claim, and what in one country is labeled bank fraud may conceal identity, process, or internal control problems.

Indicators

• Ransomware/extortion incidents mentioned or claimed during the period: multiple claims involving health care and health services, with varying levels of public confirmation.
• Exposed databases or sensitive documents in the health sector: at least one high-volume case in Brazil with 102,215 records and about 79 GB exposed.
• Financial fraud affecting health care providers: one major case in Peru involving S/ 1.406.991 and one case in Paraguay, where 350 million guaraníes were reimbursed to the clinic.
• Cases with limited or no official confirmation: several ransomware claims involving hospitals and clinics without independent public validation.
• Critical CVEs observed in the analyzed material for the period: 1 highlighted vulnerability noted in an official CTIR Gov alert, linked to SQL Server and CISA's KEV catalog.

Incidents

Brazil: massive SISVISA exposure and pressure on health surveillance

The SISVISA case is one of the strongest this month in evidentiary terms, because it does not rely on an extortion narrative or a leak on a darknet portal, but on a technical finding involving an exposed database. Jeremiah Fowler, from ExpressVPN, found a database linked to the Brazilian government’s health surveillance and licensing portal that left 102.215 documents and about 79 GB of information accessible. Security Affairs said the database contained identifiers, tax data and regulatory documents without authentication, while Computer Weekly Brasil added a broader inventory: licensing requests, authorizations, inspection reports, compliance documentation, citizen complaints and two compressed backup files.

The significance of the case goes beyond volume. In public health and health regulation, inspection documents, licensing files and citizen complaints can reveal relationships among companies, facilities, inspectors and compliance processes. In other words, this is not just isolated personal data, but an operational map of the health ecosystem. For an attacker, that can support reconnaissance, reputational extortion, document fraud or the preparation of later campaigns against providers and authorities. For the public sector, the exposure also creates an institutional trust risk: a system meant to certify and oversee ends up exposed because of configuration failures, weakening the regulatory message.

One key point in the timeline is the response after responsible disclosure. Security Affairs said public access was disabled shortly after alerts were sent to several agencies, but there was no official public response and it is not known how long the database was exposed or whether third parties accessed the files. That lack of precision matters because it prevents a full assessment of the damage. In defensive cybersecurity, exposure time matters almost as much as the type of information. A database visible for minutes, hours or days changes the risk substantially. The case should therefore be read as a warning about exposed asset governance, permission review, segregation between operational environments and verifiable remediation.

Bahia Notícias added another dimension by noting that the SISVISA discovery also contained health information from a municipality in the interior of Bahia, including care records, patients and professionals. That detail broadens the potential impact because it suggests the exposed set was not limited to generic regulatory documentation, but could include clinical or care-related information from a municipal setting. Although the source does not allow quantifying how many such records existed, it does reinforce the need to treat the exposure as a high-sensitivity incident. Operationally, the lesson is straightforward: any system connected to health surveillance, licensing or inspection should be treated as a critical asset and subject to controls equivalent to those used for an electronic health record or laboratory platform.

Brazil: Mobilemed and Kazu’s pattern against the healthcare chain

Mobilemed appeared in several threat intelligence monitors as a Kazu victim. Ransomware.live listed it with a claimed exfiltration of 23,5 TB and a ransom estimate of US$ 1,5 million, while Dexpose.io reported that Kazu had allegedly attacked the company without any public statement at the time of coverage confirming or detailing the scope of the incident. The case remains an independently unverified claim, but the pattern is consistent with the group’s behavior during August: posting multiple healthcare targets in a single day and focusing on services that support clinical operations.

Mobilemed is described as a Brazilian cloud PACS provider for medical imaging. That detail matters because a PACS is not just a technical repository, it is part of the diagnostic workflow. If a platform of this kind is compromised, the potential impact reaches care continuity, physician access to images and the integrity of radiology data. Even if the incident has not been publicly confirmed, the mere inclusion of the provider on the leak site forces customers to review contractual relationships, notification clauses, backups and failover capacity. For a hospital network, depending on an external PACS means that extortion against the provider can translate into diagnostic delays or the need to activate manual procedures.

The analytical value of the case increases when it is viewed alongside other victims listed by Kazu on the same day. Security Arsenal said that on 23 August the group published nine victims in total, seven of them healthcare organizations or health-related SaaS platforms. Medrisk.io added that among them were entities from different countries and service types: Instituto Ferrero de Neurología y Sueño, Brazil Mobilemed, Meducar, ConsultorioMovil, Centro Médico Especializado OSI and other health management services. That suggests a broad campaign focused on the ecosystem, not just large providers. From a defense standpoint, the challenge is not only securing the hospital, but also mapping the appointment provider, telemedicine provider, imaging provider and remote support provider.

Brazil: CTIR Gov warning on SQL Server and the need for immediate patching

CTIR Gov published ALERTA 76/2026 on a critical SQL Server vulnerability, recommending that vulnerable versions be identified and the vendor’s patches applied immediately. The notice also says the flaw appears in CISA’s KEV catalog and has an EPSS of 44,66%. For the healthcare sector, this is especially relevant because SQL Server often underpins electronic health record systems, laboratories, billing, ERP and auxiliary repositories. In other words, this is not a distant infrastructure component, it can be a core one.

The appearance of an official alert like this in the same month as reported exposures and ransomware claims means the risk should be read as cumulative. The issue is not only that a critical CVE exists, but that healthcare environments often combine heterogeneous versions, difficult maintenance windows and third-party dependencies. When an official notice points to KEV and a high EPSS, defensive priority should be immediate. This does not mean every SQL Server in the region is compromised, it means teams must inventory, verify exposure, review segmentation and confirm that patches were actually applied, not just approved on paper.

Peru: EsSalud Lambayeque, financial fraud and the collision between cybersecurity and internal controls

The EsSalud Lambayeque case is one of the most complex in the period because it does not fit the usual ransomware or data breach narrative, but rather a financial fraud mediated by remote access and support impersonation. The formal complaint filed by EsSalud with the National Police of Peru and the Public Prosecutor’s Office said five unauthorized bank transfers diverted S/ 1.406.991 from an account belonging to the Lambayeque healthcare network. The incident took place on 14 August, after people posing as Scotiabank support gained remote access to the entity’s devices using usernames and passwords provided by network staff.

Infobae Perú added that the modus operandi included remote access tools such as AnyDesk and UltraViewer, along with Scotiabank support impersonation to capture passwords and banking tokens. El Machete and La República reported that five unrecognized bank orders were detected, executed through different transfer mechanisms, and that ten individuals and legal entities were reported to the Divincri de Chiclayo. From an operational perspective, the case shows a mix of vectors: telephone or digital social engineering, abuse of legitimate remote administration tools and weakened approval controls in the payment flow.

The reporting became even more serious when the Second Corporate Provincial Criminal Prosecutor’s Office of Chiclayo decided to investigate four EsSalud officials for alleged embezzlement, concluding that the money outflow may have involved direct participation by those responsible for the account. That decision is key because it shifts the focus from a purely external incident to possible internal collusion or, at minimum, a serious failure of segregation of duties. For CISOs and auditors, the lesson is that technical security cannot be separated from permission management, dual-control principles and traceability in approvals. If an attacker convinces an operator to allow remote access and then executes financial transactions, the organization does not only need antivirus or EDR. It needs out-of-band human verification, strict control or prohibition of remote access software, and alerts for anomalous payment behavior.

There is a second important nuance. The case unfolded amid a public dispute with the bank. Itaú Paraguay clarified in another related incident that its systems were not breached and that the frauds were the result of attacks aimed at deceiving users. In EsSalud’s case, the affected institution demanded explanations from Scotiabank for failures in security mechanisms and asked for the recipient accounts to be frozen. In other words, responsibility is spread across the bank, the user, internal staff and control processes. That kind of friction is common in financial fraud, but it also reveals a governance weakness: when there is no prior clarity about who validates what, the incident response becomes a later negotiation instead of a preventive mechanism.

Peru: Centro Médico Especializado OSI and Kazu’s campaign against clinical services

Centro Médico Especializado OSI: Healthcare Solutions, based in Lima and focused on physical medicine, rehabilitation, physiotherapy, chiropractic care and alternative medicine, appeared on the leak site attributed to Kazu. Medrisk.io placed the case within a day in which the group published eight healthcare targets, while Security Arsenal later expanded the map to nine total victims, seven of them healthcare or health-related SaaS. Dexpose.io said the group allegedly threatened to publish sensitive medical data unless negotiations moved forward, while ransomware.live recorded a US$ 250.000 ransom for the case.

Although the institution had not issued a public statement at the time of coverage, the case matters because of the actor and the victim profile. OSI is not just an isolated clinic, the ransomware.mx bulletin described it as a healthcare provider with multiple clinics in the Lima metro area, specializing in rehabilitation and physical medicine. If an extortion actor claims access to that environment, the potential impact is not limited to administrative data. It can affect patient schedules, diagnoses, long-term treatments and relationships with insurers or referrals. And because it is a multi-site provider, an interruption can cascade across several clinics and affect patient flow in the capital.

The core point is that Kazu appears to favor targets that can support scalable extortion. By going after telemedicine, PACS, practice management and specialized centers, the group attacks links that concentrate information, credentials and operational continuity for multiple clients or sites. For a healthcare CISO, that means risk assessment must include not only the organization itself, but also its digital health partners. If the platform provider goes down, the clinic is exposed even if it was not directly breached. The defensive strategy must include an inventory of critical SaaS, MFA requirements, environment segregation, offline backups and early-notification contractual clauses.

Paraguay: Sanatorio San José, fund diversion and a dispute over the incident narrative

The Sanatorio San José case in Ciudad del Este shows how the same situation can be described differently depending on the source. Diario Vanguardia reported that Joaquín Andrés Duarte Ojeda was arrested in Areguá as part of the investigation into the diversion of 350 million guaraníes from the institution’s corporate accounts, under alleged computer fraud and unauthorized system access. The complaint filed on 31 July detailed two unauthorized transfers, one for 250 million and another for 100 million, using the username of a female employee who was not authorized to approve payments through a transaction token. The outlet added that the banking system recorded the transactions as manually entered and that authorized executives did not receive alerts or verification codes.

La Nación covered the arrest and said the sanatorium account had been "hacked," which pushed the case into public debate as an example of a breach at a private healthcare provider. However, Itaú Paraguay issued a statement clarifying that its security systems were not breached and that the events were the result of cyberattacks aimed at deceiving users into handing over access credentials. That statement does not eliminate the incident, it simply redefines the vector and shifts the focus to the user and the validation process.

Later coverage added that the case was part of a broader alleged scheme to empty bank accounts involving at least two companies defrauded for a total of about 356 million guaraníes. That suggests a reusable financial fraud operation rather than an isolated attack on a healthcare institution. For the sector, the implication is clear: administrative areas must be treated as first-tier risk surface. It is not enough to protect medical records. Corporate accounts, online banking access, supplier payment flows and account recovery procedures also need protection. A clinic or sanatorium can have strong perimeter security and still lose money if an employee authorizes remote sessions or if an attacker manages to induce manual transfer entries.

Paraguay: signs of healthcare cyber incidents and political pressure

Beyond the specific Sanatorio San José case, Paraguay saw a broader public conversation in August about cybersecurity in healthcare. In an interview on 24 August, a specialist said incidents over the past year had involved the Instituto de Previsión Social, medical data, pre-paid medicine information at several sanatoriums, imaging diagnostic services in Ingavi and private companies, insurers and cooperatives. The source did not provide technical details or specific dates, so it cannot be used to count incidents for the month, but it does reflect a growing perception of cross-cutting exposure in Paraguay’s healthcare ecosystem.

There was also Rocío Vallejo, who in a note dated 18 August mentioned recent cyberattacks on private healthcare institutions and state entities as an argument for promoting the cybersecurity law. The lawmaker also reported the theft of about US$ 5.800 from her bank account, with the National Police attributing the event to possible malware operated remotely. While that last case is not healthcare-related, it helps explain the threat climate around financial fraud in the country and why the legislative debate on digital security is gaining traction.

For a healthcare CISO in Paraguay, the lesson is twofold. First, exposure is not limited to visible ransomware. There is also account fraud, abusive remote access and possible banking malware. Second, the political conversation is moving toward a higher expectation of institutional diligence. If the public narrative starts linking healthcare with digital fragility, providers will face more pressure to demonstrate concrete controls, not just compliance statements.

Chile: Hospital Clínico Universidad de Chile on Direwolf’s leak site

Hospital Clínico Universidad de Chile was listed by Direwolf as a victim on its leak portal, according to multiple threat intelligence monitors. Ransomware.live places it as a Direwolf victim with an estimated attack date of 30 August 2026, 1.633 users compromised and 240 GB allegedly exfiltrated. HookPhish assigned it the domain redclinica.cl and dated the breach to 30 August, with discovery a few minutes later. Ransom-DB identified it as a public university hospital located in Independencia, Santiago, and noted the domain hospital.uchile.cl. Security Arsenal, meanwhile, analyzed Direwolf activity over 24 hours and found that Hospital Clínico Universidad de Chile was among three victims published in that span, two of them in the healthcare sector.

It is important to stress what is not known. None of these sources provide public confirmation from the hospital, and neither regulators nor cybersecurity firms nor the institution had officially validated the claim at the time of analysis. There is also no public technical evidence to determine whether there was encryption, only exfiltration or a mere leak-site claim. Even so, the case is operationally useful because it shows the monitoring dynamic response teams should follow. When a hospital appears on an extortion portal, even without confirmation, the minimum response includes log review, access analysis, integrity validation, communication with response partners and monitoring of later postings.

The timeline reported by HookPhish is especially interesting, with a "date of breach" at 14:35:36 UTC and discovery at 14:53:50 UTC the same day. That proximity does not prove internal detection speed, but rather the ability of a tracking system to record the leak post almost immediately. For strategic defense, the point is that external ransomware monitoring has become a complementary early-warning signal. If a hospital has a threat intelligence agreement, it should use those feeds to trigger immediate review when the institution’s name appears on an extortion site.

Argentina: Sanatorio Modelo de Caseros and Qilin’s regional expansion

Although the mentions of Sanatorio Modelo de Caseros appear in the material as a ransomware claim attributed to Qilin and without public confirmation, the case adds regional context because it joins a sequence of healthcare targets in the Southern Cone. MedRisk said that on 26 August Qilin added the private sanatorium in Greater Buenos Aires to its leak site, claiming to have stolen internal data. Hendry Adrian described a ransomware incident involving encryption of critical files and an interruption of operations, although the sanatorium had not issued an official statement at the time of coverage. Since the primary source is threat intelligence rather than institutional validation, the case should be read as an unconfirmed claim.

Even so, the timing alongside other healthcare events in August is useful for trend analysis. When an actor like Qilin adds private sanatoriums to its list, it confirms that hospitals and care centers in Argentina remain on extortion groups’ radar, even if they do not dominate national headlines. For regional CISOs, the operational point is not to wait for public confirmation before reviewing exposure. A leak-site appearance alone already calls for credential monitoring, key rotation and backup verification.

McKesson: cloud incident and the cross-border reach of the pharma supply chain

McKesson said it detected a cybersecurity incident on 25 August 2026 that included unauthorized access and data extraction from cloud-hosted accounts, confirming the intrusion and exfiltration while it continued to investigate the scope of the affected information. Although the cited coverage does not come from a Latin American source, the case matters for this report because of the pharmaceutical supply chain and its potential impact on international markets. DiarioBitcoin also reported that a hacker group claimed to have stolen millions of patient records through intrusion into several corporate cloud accounts. That figure was not confirmed by the company and should be treated as an attacker claim.

The relevance for Latin America is that global distribution and pharmaceutical service providers can be interconnected with regional operations, logistics, procurement or data support. When a company of this size confirms exfiltration from cloud accounts, the lesson for local pharma firms is obvious: cloud is not inherently secure simply because a third party manages it. Identity controls, session monitoring, privilege segmentation and anomaly detection remain shared responsibilities.