Health, Clinics, Hospitals and Pharma, Sep 2026

Active Threats and Campaigns

Ransomware and extortion with confirmed or likely impact

In September, 16 cases surfaced with ransomware or extortion as the primary focus, but only one had confirmed asset encryption according to the material provided. The rest were split between leak site mentions and cases that could not be classified, which means technical damage that was actually proven must be separated carefully from mere claims by threat actors or third-party monitoring.

That distinction matters for healthcare. A leak site can pressure a target's reputation without evidence of operational impact. A mention with no files published can support extortion or an attempt to monetize access. Confirmed encryption, as a category, changes the response profile entirely because it affects clinical availability and continuity of care.

Among the month's cases, AmorSaúde, Grupo Hospifar, and the Hospital Clínico de la Universidad de Chile fell into the gray area of attribution or partial confirmation, while the Hospital Santa Marta case belongs to a judicialized episode from 2022, not a new September campaign. By contrast, the attack on the Hospital Clínico de la Universidad de Chile does appear as a confirmed incident with unauthorized access and data leakage, although the material does not classify it as encryption.

Fraud and phishing

There were no documented fraud or phishing cases in the September material. The absence of cases in this category should not be read as the absence of regional risk, but as a lack of verified cases within the corpus analyzed for the month.

That gap has its own meaning. In healthcare, phishing often works as an initial access vector or as a complement to ransomware campaigns, but it does not always generate separate public coverage. If the monthly report does not show it, that does not necessarily mean it did not happen, only that there was not enough documentation or that it was absorbed into another type of incident.

APT and hacktivism

There were also no documented APT or hacktivism incidents as the main focus during the period. The closest examples were preventive alerts about forum posts, claims by threat actors, and a warning about a possible defacement against sites of Paraguay's Superintendencia de Salud, but with no independent confirmation of access or authorship.

For operational readers, that means the month did not show advanced persistence campaigns against healthcare in the material received, although it did leave a broad exposure surface attributed to extortion groups and opportunistic publishing actors. The line between hacktivism and criminal activity remains blurry in public reporting, but the September corpus does not provide solid evidence to classify those cases as APT.

Critical vulnerabilities

September again put critical vulnerabilities on the regional healthcare sector’s agenda. The material compiled 11 critical CVEs, several with active exploitation, official advisories, or inclusion in exploited vulnerability catalogs. These are not pure healthcare flaws, but software and devices that can affect clinical services, management systems, or connected infrastructure.

The defensive reading is straightforward. Not all of these flaws belong to the healthcare sector, but several affect components commonly found in hospitals, clinics, and laboratories, such as load balancers, gateways, network stacks, and integration middleware. That means the priority is not only patching visible clinical systems, but also reviewing network layers and gateways that support day-to-day operations.

CISA’s material on lwIP is especially relevant for environments with connected devices or embedded equipment. The cited advisories did not report specific public exploitation, but the fact that Healthcare and Public Health appears as relevant critical infrastructure means these vulnerabilities should be treated as potentially applicable to healthcare ecosystems with telemetry, sensors, or connected medical devices.

Regulation and compliance

No documented regulatory moves were recorded in the September material. That does not mean the month lacked legal or institutional consequences, because there was a relevant ruling in Brazil and a criminal complaint in Chile. The difference is that those developments are counted here as incidents or judicial responses, not as regulatory changes.

The decision involving Hospital Santa Marta shows how litigation can close the loop on an attack years later. The criminal complaint filed by the Hospital Clínico de la Universidad de Chile marks a different path, the institution turns the incident into a criminal action while the cybersecurity agency reports the event. Both processes reinforce the expectation of traceability and evidence preservation in healthcare.

From a compliance standpoint, the month leaves a straightforward signal. Institutions must not only respond to the incident, but also document access, separate compromised accounts, preserve logs, and decide when to notify regulators, patients, or authorities. The September material shows that when that sequence fails, the discussion moves to courts or to external monitoring by third parties.

Countries and subsegments most affected

Chile

Chile stood out for two types of signal. On one hand, there was the confirmed case involving the Hospital Clínico de la Universidad de Chile, with unauthorized access to medical information and a subsequent lawsuit. On the other, there were preventive alerts and unconfirmed reports about Clínica Universidad de los Andes, which shifted the conversation toward possible exposure of structured clinical data.

The hardest-hit subsegment was hospitals, especially imaging and consultation systems. Chile matters less for the raw number of incidents than for the quality of the evidence: there is direct confirmation, an official filing, and a clear public narrative around access to medical data. That gives the country disproportionate weight compared with other, more ambiguous cases.

Brazil

Brazil contributed two different signals. The first was judicial, with the upholding of convictions in the Hospital Santa Marta case. The second was operational, with the incident at Farmanguinhos that affected the production and shipment of supplies. One touches the criminal side of ransomware and extortion. The other affects the industrial continuity of a pharmaceutical player.

The pharmaceutical subsegment deserves particular attention because the Farmanguinhos case shows that a cyber incident can hit the supply chain without a ransomware statement being issued. That kind of event often takes time to become visible to the public, but it can disrupt schedules, inventories, and deliveries.

Colombia

Colombia had the highest density of contextual reporting, even if it did not have the most individually confirmed cases during the month. Portafolio reported 410 ransomware attacks and claims against healthcare providers and companies in the first half of 2026, with 247 affecting hospitals, clinics, and other direct providers. Other coverage built around the same topic insisted that 60% of reported cyberattacks targeted health care.

That material should not be confused with pure telemetry or with verified September incidents, but it does explain why the country keeps appearing in regional conversations. For Colombian health care, the issue is not just frequency. It is the persistence of an attack model that combines reputational pressure, extortion, and exposure of patient records or care platforms.

Paraguay

Paraguay appeared in September with preventive alerts involving the Ministry of Public Health and Social Welfare and the Health Superintendence. The material refers to a supposed 10.5 GB publication, a possible defacement campaign, and a database of subdomains, but in all cases the source or monitoring notes that there is no independent confirmation.

The value of the case lies in the pattern. Actors or forums use the names of health agencies to create pressure, even when the evidence remains vague. For a security team at a health ministry or regulator, that means monitoring not only internal infrastructure but also the public exposure of subdomains, admin panels, and download repositories.

Argentina and Dominican Republic

These two countries appear tied to the Hospifar discussion, but with an important caveat: the material does not allow the incident to be placed in a single geography with confidence. One record classifies it as Argentina, while DeXpose describes it as a health organization in the Dominican Republic. That discrepancy rules out any definitive country-level reading.

Even so, the case is a reminder that geographic attribution is a critical stage of analysis. If it is not resolved correctly, a report can overstate or understate country risk. Here, the only solid conclusion is that there was a ransomware claim against a health care or pharma actor, with no public evidence strong enough to close the question of location or impact.

Trends and signals to watch

The first trend this month is a drop in volume compared with August, paired with a higher share of unclassified incidents. The previous period had been dominated by ransomware, while September was led by incidents. That points to less public clarity and a wider range of situations, not necessarily lower real risk.

The second signal is that fraud and phishing cases fell to zero in the material reviewed. That should not be celebrated as a structural improvement. It looks more like a gap in monthly documentation. In healthcare, these campaigns are often absorbed as initial access or supporting pieces of larger operations, and they are not always published as standalone events.

The third signal is the rebound in critical CVEs, from 2 to 11 versus the prior month. That jump should not be read as a wave of exploitation in Latin American hospitals, but it does serve as a reminder that the technical attack surface is active. Alerts from CISA and Check Point show that exposure windows can emerge in network software, gateways, and integration tools that support clinical services.

The fourth signal is the persistence of unconfirmed claims, especially in cases involving clinics, hospitals, and ministries. Hospifar, AmorSaúde, Clínica Universidad de los Andes, and Paraguay share a pattern, actors or trackers publish alerts before official validation exists. For security teams, that requires separating noise from real impact, without ignoring it. In many cases, the claim comes before a negotiation or a later disclosure.

The comparison with August also leaves one useful data point. There were more ransomware reports the previous month, but in September the most consistent signal was incidents and partial confirmations. In other words, the risk did not disappear, it shifted toward a less visible mix of unauthorized access, data leakage, and disrupted continuity.

Security team recommendations

This month’s priorities are practical and concrete. First, strengthen visibility into imaging systems, consultation portals, integration middleware, and gateways that connect clinical environments with external services. The Hospital Clínico de la Universidad de Chile case shows that a compromised imaging account can be enough to expose sensitive medical information and force service interruptions.

Second, review credentials and active sessions tied to public domains, vendors, and care platforms. The AmorSaúde and Hospifar cases show that third-party disclosures often mix accounts, credentials, and user data with incomplete evidence. The right response is not to assume the entire set belongs to ransomware, but to cut access, rotate secrets, and verify whether credentials were reused.

Third, prioritize patches and mitigations for the components named in September’s advisories. It is not enough to look at visible clinical software. Load balancers, gateways, embedded stacks, and integration solutions such as Mirth Connect also need review, because they concentrate flaws that can open the door to remote code execution or denial of service.

Fourth, prepare legal and forensic response before the incident escalates. The ruling on Hospital Santa Marta and the complaint filed by Hospital Clínico de la Universidad de Chile show that digital evidence ends up being central. If an institution does not preserve logs, freeze accounts, and document chain of custody properly, it weakens its defense and attribution options.

Fifth, train business continuity around partial impact scenarios, not only full encryption. Farmanguinhos is a good example of a production interruption that does not necessarily fit the classic ransomware model. Pharmaceutical and hospital organizations should rehearse what happens if a dispensing system, an imaging platform, or an e-prescribing component goes down.

Frequently Asked Questions

What type of events dominated September among incidents, ransomware, and leaks?

Unclassified incidents dominated, with 20 cases out of 53 verified. That is more than the 16 cases where ransomware or extortion was the main focus, and it shifted the month’s signal toward intrusions, disruptions, and partial exposure. See also the monthly executive summary and period indicators sections.

Which cases were best confirmed, and which remained in a gray area?

The best-confirmed case was Hospital Clínico de la Universidad de Chile, with unauthorized access and exposure of medical information. AmorSaúde, Hospifar, Clínica Universidad de los Andes, and several alerts involving Paraguay remained in a gray area, because the material only provides claims, monitoring, or unverified posts. See Relevant incidents and Active threats and campaigns.

What does the comparison with August reveal about regional risk?

It shows lower overall volume, less ransomware, and less documented phishing, but more critical CVEs mentioned and more unclassified incidents. In other words, the month was not calmer, just less readable. Risk remained high because of the sensitivity of the assets, even though the visible form of the threat changed. See the month’s regional overview and Trends and signals to monitor.

Which countries provided the most useful signal for defense this month?

Chile provided the clearest confirmation of clinical impact, Colombia provided the broadest context of pressure on healthcare, Brazil combined a legal case and an operational one, and Paraguay showed preventive alerts involving health agencies. Argentina and the Dominican Republic were left with unresolved geographic attribution in the Hospifar case. See Most affected countries and subsectors.

Which vulnerabilities should healthcare teams review first?

First, those with active exploitation or CISA and Check Point advisories, such as CVE-2026-94127, CVE-2026-85102 and CVE-2026-93616. Then, the lwIP issues and those affecting Mirth Connect and other integration platforms. The key criterion is not only technical severity, but exposure in hospital and pharmaceutical networks. See Critical vulnerabilities.

Material limitations

This report was built exclusively from the material provided for September 2026 and from the sources available for citation. No internet was used, and no telemetry outside the listed sources was incorporated. Facts without a confirmed date were used only as context and are not included in the period indicators.

An indicator at 0, especially in CVEs, means none were recorded in the material analyzed for this month, not that no critical vulnerabilities or exploitation existed in the region. The same applies to fraud, phishing, or regulation. Absence in the corpus does not equal actual absence of activity.

The declared time window for the indicators is 54 dated events in September 2026 and 1 without a confirmed date excluded from the indicators. The comparative data with the previous month are reproduced exactly as provided and were not recalculated. Where the material does not allow the exact type of impact to be determined, the classification was kept as undeterminable.

Also excluded from interpretation as incidents were aggregated telemetry figures, attempts or automated blocks, and detection measurements. Those references can help contextualize exposure, but they do not prove intrusion or confirmed impact. Sources outside the authorized list were also avoided, including disallowed social media and promotional material that does not serve as an independent basis for trend analysis.