Actor claims Chile hospital breach, sells patient data and root access
A threat actor on a dark web forum claims to have compromised Hospital San Juan de Dios in San Fernando, Chile, and is selling root-level server access, admin portal credentials and a 96GB dump across 39 databases. The actor says the haul includes about 207,000 files (47GB) of patient data with names, RUT national ID numbers and dates of birth. The claim is unverified; the hospital should investigate and notify affected patients if confirmed.
What happened
A threat actor on a dark web forum claims to have breached Hospital San Juan de Dios in San Fernando, Chile. According to DailyDarkWeb, the actor is selling root-level server access, admin portal credentials and a 96GB dump across 39 databases. The hospital has not confirmed an incident.
Why it matters
If genuine, clinical records tied to RUT numbers expose patients to identity theft, medical fraud and extortion, per DailyDarkWeb's analysis. Live admin access could let attackers disrupt hospital systems. Health data commands high value to criminals.
What to do
Watch for official confirmation from the hospital. If confirmed, support the investigation, notify affected patients and monitor for misuse of the exposed data.
For the technical team
- Affected
- Hospital San Juan de Dios, de San Fernando (Chile); alegado acesso root e base de pacientes · Hospital San Juan de Dios, San Fernando, Chile; server and 39 databases holding patient data, per the claim.
- Exploitation
- Unverified claim by a threat actor on a dark web forum, reported by @DailyDarkWeb. The hospital has not confirmed an incident; no exploitation confirmed.
- Fix
- No software to update
- Vector
- Not described. The actor claims to sell full root-level server access and admin portal credentials; the initial entry path was not disclosed.
- More details
- Sale package: 96GB dump across 39 databases; about 207,000 files (47GB) of patient data with names, RUT national ID numbers, dates of birth, clinical records and diagnoses; list of 374 staff email addresses. DailyDarkWeb analyst note: if genuine, the data enables identity theft, medical fraud and extortion, and live admin access could disrupt hospital systems.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
