Ransomware group Whitearmor hits Clínica La Sagrada Familia (Colombia)
Clínica La Sagrada Familia (Colombia) — a healthcare target operating in CO has been listed by the Whitearmor ransomware group on 2026-11-08. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Clínica La Sagrada Familia (Colombia) |
|---|---|
| Threat Group | Whitearmor |
| Summary | Clínica La Sagrada Familia (Colombia), a healthcare organization in Colombia, was listed by the Whitearmor ransomware group on its leak site on 2026-11-08. |
| Date of Breach | 2026-11-08 |
| Discovery Date | 2026-11-08 |
| Region | CO |
| Target Domain | — |
| Business Sector | Healthcare |
| Severity | MEDIUM |
Claim by Whitearmor
Clínica La Sagrada Familia S.A.S, a private healthcare provider in Colombia's Eje Cafetero region. It offers medium and high-complexity medical services, online appointment scheduling, and features advanced technology like a 160-slice CT scanner. We hold, in short: 254,670 patient identities with Colombian government IDs, ~598.7M rows of clinical + financial + identity data across 4,573 tables from a Colombian hospital's full production database, including MD5-hashed staff credentials, 691K admissions, 34.5M medical-history rows, 1.5M invoices, and complete pharmacy/lab operations. We demand $2,000,000 in BTC, emails with instructions have been sent to you. If you have not received them, you can find our contacts below. Email: whitearmorxd@onionmail.org Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Posted by the Whitearmor threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Leak post (onion / Tor)
http://whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.