Brazil adds another hospital attack in 2026

August 20, 2026 update: ransomware.live says SPDM, via spdm.org.br, is listed in Brazil under the Hospitals & Clinics sector with estimated revenue of $197 million. That data reinforces that the group is also targeting large Brazilian healthcare providers, in addition to the public claim of 847 GB of data.

ransomware.live listed Global Secret Group as a victim of a ransomware incident discovered on July 26, 2026, in Brazil. The organization is categorized under Hospitals & Clinics, putting Brazilian healthcare providers back in focus within the attack map published by the project.

A sector under pressure

The data fits into a broader context already flagged by CISO Advisor, cited by Vantico, which reported that in 2026 the healthcare sector accounts for 51% of ransomware attacks in Latin America. Brazil stands out in that statistic, with hospitals and clinics among the most frequently targeted organizations.

The ransomware.live database for healthcare in Brazil also shows another recent case. Reni Farmácias Associadas, a chain tied to healthcare services in the country, is listed as a victim of the Doommageddon group in an incident discovered on July 19, 2026. In the same pattern, the Global Secret Group entry extends the series of incidents against organizations in the sector.

Claimed data on SPDM

The scope of the incident involving Global Secret Group was further reinforced by a post from Galaxy Warden. According to that report, the Brazilian healthcare provider SPDM, identified at spdm.org.br, was publicly listed on the group's leak site on July 26, 2026, with a claim of 847 GB of stolen data, equal to 871,912 files spread across 76,047 folders.

In the same ransomware.live dataset, SPDM also appears in Brazil under the Hospitals & Clinics sector with estimated revenue of $197 million, a figure that suggests the actor is also going after larger Brazilian healthcare providers. The posting expands what is known about the incident beyond confirmation of the attack and places SPDM among the Brazilian healthcare organizations exposed on ransomware-linked leak sites.

Attack map in Brazil

The activity recorded by ransomware.live in Brazil's Healthcare category shows that the country continues to accumulate confirmed incidents against hospitals, clinics, pharmacies and other healthcare providers. Among the cases collected for 2026 are actors such as Doommageddon and Global Secret Group, while the tracking angle for the 2024 to 2026 period also includes Beast, Direwolf, Killsec, Sarcoma, Incransom, Akira and TheGentlemen.