BRIEFRansomwarehighP64
n0n ransomware leaks 315 million patient records from LEO Pharma
LEO Pharma A/S
Detected12 November 2026 · 18:14 UTC
The n0n group listed Danish pharmaceutical firm LEO Pharma and published about 315 million patient records with age, gender, three-digit ZIP, prescription counts and 100+ diagnosis indicators, plus 441,000 transaction-level support-program records. It is among the largest healthcare exposures reported to date and enables medical identity fraud and highly targeted phishing. This matters well beyond Denmark given the scale.
CategoryRansomware
Severityhigh
Priority score64
Detected12 November 2026 · 18:14 UTC
RansomwarePriority 50
Ransomware Panzer publica al Ministerio de Salud de MalasiaThe Panzer ransomware group listed the Ministry of Health of Malaysia, a government and defense sector victim, on its leak site. Government health data is highly sensitive and disruption to public health systems can directly affect citizens. Public-sector defenders should verify exposure and harden backups and identity controls.RansomwarePriority 36
Ransomware krybit publica a la fabricante turca CeytechThe krybit ransomware group published Ceytech Makina, a Turkish industrial machinery manufacturer, on its leak site. Ransomware against an industrial manufacturer can disrupt supply chains and IT/OT operations. Monitoring is warranted, though the victim is outside the Argentina/LATAM focus.RansomwarePriority 72
Ransomware Metaencryptor publica al proveedor de TI sanitario ProMantraProMantra, Inc. is a US healthcare IT and BPO firm in Somerset, New Jersey that handles medical billing, coding and claims for hospitals and physician groups. The metaencryptor ransomware group listed it as a victim on ransomware.live, indicating a likely compromise of sensitive healthcare and billing systems. Healthcare defenders should treat this as third-party risk and watch for leaked patient and claims data.RansomwarePriority 45
Ransomware thegentlemen publica a la mexicana PrinselThe 'thegentlemen' group listed Prinsel, a Mexican children's footwear and clothing manufacturer in Toluca with 66 years of history and roughly 200-500 employees. As a LATAM consumer-goods manufacturer operating retail and distribution networks, it holds supplier and customer data. This is a fresh regional ransomware victim worth tracking for leaked commercial records.RansomwarePriority 46
Ransomware thegentlemen publica a la brasileña Solarium RevestimentosThe 'thegentlemen' group listed Solarium Revestimentos, a São Paulo-based manufacturer and distributor of ceramic tiles and decorative panels with 20+ years in the market and roughly 50-150 employees. As a LATAM industrial manufacturer, it sits in a supply chain serving construction and retail clients. A fresh regional ransomware victim worth monitoring for leaked commercial data.RansomwarePriority 50
Ransomware thegentlemen publica al grupo mexicano San CristóbalThe 'thegentlemen' group listed Grupo San Cristóbal, a Mexican multi-service group in Mexico City offering property management, accounting, construction and legal services with 250+ employees and 2,800 managed properties. The victim handles sensitive client financial and property data. This is a fresh LATAM private-sector ransomware victim with potential client-data exposure.