Clínica La Sagrada Familia Ransomware Claim by Whitearmor (Nov 2026)

Claim Summary

On or around November 8, 2026, the ransomware group known as Whitearmor allegedly posted Clínica La Sagrada Familia S.A.S to its dark web leak site. According to the threat actor, the target is a private healthcare provider operating in Colombia’s Eje Cafetero region that offers medium and high-complexity medical services, online appointment scheduling, and advanced diagnostic technology including a purported 160-slice CT scanner.

The group claims to have exfiltrated a large volume of data and is demanding a $2,000,000 payment in Bitcoin. The actors state that extortion emails with instructions have already been sent to the organization. None of these claims have been independently verified, and the victim has not publicly confirmed the incident at the time of writing.

Threat Actor Profile

Whitearmor is a relatively low-profile ransomware operation. Public research on this group is scarce. Its total number of known victims is unknown, and no established toolset, malware family, or documented tactics, techniques, and procedures (TTPs) have been publicly attributed to it. No YARA rules or detection guidance specific to Whitearmor are currently available in open sources.

Because the group lacks a documented track record, its credibility should be treated with caution. The claim includes technical specifics (table counts, row volumes, hashing schemes) that are typical of leak site posts designed to signal authenticity and pressure victims, but such details are easily fabricated or exaggerated. Analysts should not assume the group possesses the data it describes until independent corroboration exists. Organizations should monitor for follow-on activity and treat any Whitearmor-branded communication as unverified until validated.

Alleged Data Exposure

According to the threat actor, the claimed dataset includes:

• 254,670 patient identities with purported Colombian government IDs
• Approximately 598.7 million rows spanning clinical, financial, and identity data across 4,573 tables
• MD5-hashed staff credentials
• 691,000 admissions records
• 34.5 million medical-history rows
• 1.5 million invoices
• Complete pharmacy and laboratory operations data

These figures are unverified and may be inflated. MD5 hashing, if accurately described, is a weak algorithm and would represent a serious credential exposure risk if the claim is true. No data samples, download links, or access details are included in this report by policy.

Potential Impact

If the claim is accurate, the exposure of patient identities, government IDs, clinical histories, and financial records would constitute a significant privacy and regulatory event under Colombian data protection law. Healthcare data is among the most sensitive categories, and affected patients could face identity theft and fraud risk. Exposed staff credentials, even hashed, could enable lateral movement if reused elsewhere. Operational disruption to scheduling, pharmacy, and laboratory systems is also possible. All of this remains speculative pending verification.

What to Watch For

• Official statements from Clínica La Sagrada Familia or Colombian health authorities
• Regulatory notifications from Colombia’s data protection authority
• Evidence of leaked data appearing in criminal forums or resale channels
• Password reuse or credential-stuffing activity tied to staff accounts
• Follow-on extortion or double-dipping attempts by the group

Disclaimer

This report is based solely on an unverified claim published on a ransomware leak site. Yazoul Security has not independently confirmed the breach, the data volume, the data contents, or the involvement of Whitearmor. Ransomware groups routinely exaggerate claims to pressure victims into payment. Nothing in this report should be treated as fact or as confirmation that any data was accessed or exfiltrated. Readers should await official confirmation from the organization or authorities.