The Gentlemen claims attack on Mato Grosso state health
The Gentlemen ransomware group listed the Secretaria de Estado de Saúde de Mato Grosso (SES-MT) on its leak site on Nov 2, 2026, without publishing a data volume or describing what it took. SES-MT, which serves 141 municipalities and about 3.6 million residents, has not commented and no new breach has been confirmed. It is the department's second reported ransomware incident this year, after a confirmed March 2026 attack that local reporting tied to LockBit.
What happened
The Gentlemen ransomware group listed the Secretaria de Estado de Saúde de Mato Grosso (SES-MT), the state health department of Mato Grosso, Brazil, on its leak site on Nov 2, 2026. The group has not published a data volume or described what it took. SES-MT has not commented and no breach has been confirmed.
Why it matters
SES-MT runs state hospitals, laboratories, blood centers and a free medication program for 141 municipalities and about 3.6 million residents. State health systems hold patient, lab and procurement records that are prime extortion leverage, according to the source. If confirmed, this is the department's second ransomware incident in 2026, which the source reads as either a new intrusion or lingering access.
What to do
Watch for a statement from SES-MT and monitor the group's leak site. Organizations that share data or integrations with SES-MT should review those connections and accounts. Check whether their own data appears in future publications by the group.
For the technical team
- Affected
- Secretaria de Estado de Saúde de Mato Grosso (SES-MT), que gere a saúde pública de 141 municípios e cerca de 3,6 milhões · Secretaria de Estado de Saúde de Mato Grosso (SES-MT): public healthcare for 141 municipalities and about 3.6 million residents, including state hospitals, laboratories, blood centers and a free medication program.
- Exploitation
- Unverified claim. Listing on The Gentlemen's leak site on Nov 2, 2026, reported by DailyDarkWeb. No data volume published and no comment from the victim.
- Fix
- No software to update
- More details
- Second reported ransomware incident at the department this year, per DailyDarkWeb: SES-MT confirmed a cyberattack in March 2026, which local reporting tied to LockBit, and said affected data was recovered and no ransom was paid. Source analyst note: a repeat listing within months points to either a new intrusion or lingering access; no new breach confirmed.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
