All ransomware incidents
Ransomware group thegentlemen hits CLIMEDI
CLIMEDI — a healthcare target operating in BR has been listed by the thegentlemen ransomware group on 2026-10-14. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | CLIMEDI |
|---|---|
| Threat Group | thegentlemen |
| Summary | CLIMEDI, a healthcare organization in Brazil, was listed by the thegentlemen ransomware group on its leak site on 2026-10-16. |
| Date of Breach | 2026-10-14 |
| Discovery Date | 2026-10-16 |
| Region | BR |
| Target Domain | climedi.com.br |
| Business Sector | Healthcare |
| Severity | MEDIUM |
Claim by thegentlemen
climedi.com.br CLIMEDI private multidisciplinary medical clinic and diagnostic center in Aracaju, Sergipe, Brazil — founded 5 Oct 1977 by Dr. João Antônio Macedo Santana (endocrinologist & nuclear medicine physician, UFS professor, SUNY Upstate NY–trained). Family-run (Santana-Macedo dynasty: João, son Gustavo, daughter Sara), with 76–121 staff, 50+ physicians across 3 units. Its unique regional edge: full nuclear medicine — PET-CT, scintigraphy, and I-131 thyroid cancer therapy with 5 CNEN-compliant isolation suites — plus 20+ specialties (endocrinology, cardiology, gastro, mastology, orthopedics, ENT, neuro) and complete diagnostics (MRI, CT, mammography, endoscopy, bone densitometry, 54+ tests). Quality credentials: PNCQ "Excelente" (highest tier), SBAC, DICQ; registered in CNES, works with SUS, private insurers, and union health plans (APCEF+). Government payments total R$ 11M+ (Portal da Transparência); private revenue undisclosed (est. R$ 20–50M/yr).
Posted by the thegentlemen threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.