Einstein confirms access to patient data

Update November 1, 2026: Einstein Israelite Hospital clarified that it detected the suspected incident on August 4, 2026, and took technical and operational steps to investigate and contain it. It also emerged that the potentially exposed information included names, CPF numbers, birth dates, prescriptions and exam results, while police and the ANPD continue to handle the case.

Einstein Israelite Hospital confirmed that unauthorized parties accessed and obtained part of its patient database. The institution said it remains operational, with care systems, patient service platforms and the electronic medical record still running, and that it is still working to determine exactly what information was reached and how many people were affected.

What did Einstein confirm about the incident?

Einstein confirmed that there was improper access to part of its patient databases and that unauthorized individuals obtained that information. According to TI Inside, the hospital also said potentially affected individuals will be notified individually by email.

The institution also said, according to the same coverage, that it had not identified evidence of public disclosure, leakage or misuse of the data, although the investigation into the scope of the access was still ongoing.

What data may have been exposed?

The potentially exposed information included names, CPF numbers, birth dates, prescriptions and exam results, according to PSafe. The hospital was still determining exactly which information was accessed and how many people were affected.

That detail adds to the initial description of the case, but it does not change the central point already confirmed by the institution: there was unauthorized access and part of the patient database was obtained.

What is known about the investigation?

Brazil’s Federal Police carried out Operation Insidioso in the context of an investigation that began after a report from an institution about the extraction of sensitive data followed by a payment demand. That link appears in Minuto da Segurança’s coverage, but it has not been independently confirmed as server encryption or as an interruption of hospital services.

Minuto da Segurança connects the investigation to the Einstein case and to a possible extortion scenario, although it presents those points as source attribution rather than independently verified facts in the available material.

The incident was reported to the National Data Protection Authority (ANPD) and formally brought to the Federal Police, which is investigating the case, according to O Globo. That is the institutional path reflected in the latest coverage.

What sets this case apart from confirmed ransomware?

The available material distinguishes between unauthorized access and a formal ransomware confirmation. In Einstein’s case, what has been verified is unauthorized data access and the continued operation of its systems. By contrast, SOC Prime describes Dire Wolf as a double extortion ransomware family with specific technical capabilities.

SOC Prime says Dire Wolf uses a Go-based encryptor packaged with UPX, relies on ChaCha20 and can delete shadow copies and disable Windows recovery. That description applies to the ransomware family itself, not to any official attribution of the Einstein incident to that group.

What does the observatory say about the region?

The ACSec observatory’s coverage of Dire Wolf and Diario Financiero’s reference point to a regional context in which healthcare and critical infrastructure are among ransomware victims in Latin America. That material does not change what was reported about Einstein, but it does place the case within a broader set of incidents affecting organizations across the region.

The available documentation separates two tracks: on one hand, Einstein’s institutional confirmation of data access, and on the other, the presence of active ransomware families in the region using double extortion techniques, such as Dire Wolf.