Threat actor claims leak of 14.8 million records from Cayetano Heredia hospital
A threat actor has published a database they claim was stolen from Hospital Nacional Cayetano Heredia (HNCH), a major public hospital in Lima, Peru. The actor says it holds 14.8 million records tied to about 2.5 million people, including national ID (DNI) numbers, contact details and clinical data. The hospital has not confirmed an incident and the data is unverified; patients should watch for medical fraud, identity theft and scams.
What happened
A threat actor has published a database they claim was stolen from Hospital Nacional Cayetano Heredia, a major public hospital in Lima, Peru. The actor says it holds 14.8 million records tied to about 2.5 million people. The hospital has not confirmed a breach and the data is unverified.
Why it matters
If genuine, the leak pairs national ID numbers with clinical details, a combination that enables medical fraud, identity theft and scams citing real hospital visits. It affects patients of a public hospital. The monitoring service that reported the claim called this, if true, one of the most sensitive health data exposures in Peru this year.
What to do
Treat this as an unverified claim until the hospital responds. Companies handling health data should review access controls and monitor for patient data exposure. Patients should be wary of calls and messages citing hospital visits or payment requests.
For the technical team
- Affected
- Hospital Nacional Cayetano Heredia (HNCH) Banco de dados de pacientes do Hospital Nacional Cayetano Heredia (HNCH), hospital público de Lima, Peru, segundo alegaç · Patient database of Hospital Nacional Cayetano Heredia (HNCH), a major public hospital in Lima, Peru, the claimed target of the publication.
- Exploitation
- No vulnerability exploitation reported. The database was published by an unnamed threat actor, according to DailyDarkWeb; the claim is unverified and the hospital has not confirmed an incident.
- Fix
- No fix or mitigation cited in the sources. The hospital has not confirmed the incident.
- Vector
- Component and failure type not described in the sources. The threat actor only claims the database was stolen; no vulnerability or exploitation condition was mentioned.
- More details
- Data claimed in the publication: national ID (DNI) numbers, names, dates of birth, addresses, phone numbers, email addresses, medical record numbers, triage details, chief complaints, diagnosis codes and insurance affiliation numbers. DailyDarkWeb notes the data may include older records. No group was named and no theft date was given.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
