VORANT. Threat Intelligence Sign in Get the full feed

Rhysida claims General Santos Doctors Hospital breach

high threat healthcare

Rhysida ransomware group claims theft of 2.44TB and 3.5M files from a Philippine hospital, including patient PHI, staff records, and financial data.

Ransomware.live tracking indicates the Rhysida ransomware group has listed General Santos Doctors Hospital (Philippines) as a victim, claiming exfiltration of approximately 2.44TB of data across 3.5 million files. The claimed data set is extensive and highly sensitive for a healthcare entity, spanning patient health information (named scans from surgical pathology and hemodialysis departments, cancer-center dossiers with PhilHealth IDs, NICU data, lab results tied to birth dates), staff and HR records (physician registers with PRC license numbers and cell numbers, payroll workbooks, passport scans, drug-test files), and sensitive corporate/financial material (audited financial statements, bank account details across six-plus banks, internal audit memos on cash discrepancies, SEC stockholder minutes, and personal contact details of hospital leadership).

No technical details of the intrusion vector, malware used, or exploited vulnerabilities are provided in this listing — it is a victim-claim entry from a ransomware leak-site tracker rather than a technical incident report. Defenders in the healthcare sector, particularly in the Philippines, should treat this as an indicator of continued Rhysida targeting of hospitals and healthcare providers, a sector this group has repeatedly hit. Organizations should review exposure of PHI and financial data, ensure segmentation between clinical, HR, and financial network shares, and validate backup integrity and incident response readiness given the scale of data claimed to have been exfiltrated.

As this is a leak-site claim without independent verification of the underlying stolen data or confirmation from the hospital, defenders should treat specifics as unverified pending official disclosure, while still using this as a prompt to assess resilience against similar double-extortion ransomware activity targeting healthcare organizations.

Mentioned in this report

Threat actors rhysida
Malware Rhysida

Related reporting

Detection guidance

Ransomware File Encryption Activity: Mass File Modification with Suspicious Extension

ATT&CK T1486

Detects rapid mass file creation/modification across multiple directories with suspicious ransomware-associated file extensions, typical of encryption payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: 'Ransomware File Encryption Activity: Mass File Modification with Suspicious
  Extension'
description: Detects mass file modifications or creations with ransomware-associated
  extensions (commonly used by Rhysida and similar groups) across multiple directories
  in short timeframe. Focuses on the distinctive pattern of bulk file-write operations
  with encrypted-file markers rather than specific filenames.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
    - .rhysida
    - .locked
    - .crypt
    - .encrypt
    - .ransom
  filter_user_temp:
    TargetFilename|contains:
    - \AppData\Local\Temp\
    - \Windows\Temp\
  filter_installer_activity:
    Image|endswith:
    - \msiexec.exe
    - \setup.exe
  condition: selection and not (filter_user_temp or filter_installer_activity)
falsepositives:
- Legitimate backup or encryption software writing to disk with custom extensions
- Development or testing frameworks using standardized encryption markers
level: high
id: 494c15b8-d066-5135-8f8e-3dd68d527c49
status: experimental
author: Vorant

Suspicious Archive Creation with Large File Count

ATT&CK T1567

Detects creation of large archive files (7z, rar, zip) containing thousands of files, indicative of data staging for exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Archive Creation with Large File Count
description: Detects creation of compressed archive files (7z, rar, zip, tar) by non-system
  processes, particularly when archive contains large numbers of files or is staged
  in user-accessible directories. Typical pattern for pre-exfiltration staging in
  ransomware/data-theft operations.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: file_event
  product: windows
detection:
  selection_archive_creation:
    TargetFilename|endswith:
    - .7z
    - .rar
    - .zip
    - .tar
    - .tar.gz
  selection_suspicious_path:
    TargetFilename|contains:
    - \Users\
    - \ProgramData\
  filter_known_software:
    Image|endswith:
    - \7z.exe
    - \WinRAR.exe
    - \WinZip.exe
    ParentImage|endswith:
    - \explorer.exe
    - \shell.exe
  filter_admin_tools:
    Image|endswith:
    - \backup.exe
    - \robocopy.exe
  condition: (selection_archive_creation and selection_suspicious_path) and not (filter_known_software
    or filter_admin_tools)
falsepositives:
- IT administrators using 7z/WinRAR for routine data backup staging
- Legitimate software update mechanisms creating temporary archives
level: medium
id: a3af6ac1-f999-5637-8e8d-1960c880803b
status: experimental
author: Vorant

Suspicious Web Upload Activity from File Archival Process

ATT&CK T1567

Detects network connections from archive utilities (7z, rar, zip, tar processes) to external IP addresses over HTTP/HTTPS, indicating exfiltration of staged data. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Web Upload Activity from Archive/Compression Process
description: Detects archive or compression utilities (7z.exe, rar.exe, WinRAR, tar)
  initiating outbound network connections to non-local IP addresses over web protocols
  (HTTP/HTTPS). Typically associated with data exfiltration staging and upload operations.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \7z.exe
    - \rar.exe
    - \WinRAR.exe
    - \tar.exe
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
  filter_localhost:
    DestinationIp:
    - 127.0.0.1
    - ::1
    - 192.168.0.0/16
    - 10.0.0.0/8
    - 172.16.0.0/12
  filter_local_domain:
    DestinationHostname|endswith:
    - .local
    - .internal
  condition: selection and not (filter_localhost or filter_local_domain)
falsepositives:
- Archive utilities configured to sync or upload backups to corporate cloud storage
- Development tools using 7z or tar as part of automated deployment pipelines
level: high
id: a21b159c-4b0e-5838-b87f-27046117e434
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/R2VuZXJhbCBTYW50b3MgRG9jdG9ycyBIb3NwaXRhbEByaHlzaWRh

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free