Peru’s Cayetano Heredia Hospital Faces 14.8 Million-Record Data Leak Claim

As DailyDarkWeb posted on its handle on X, a threat actor claimed to have leaked a database belonging to 2.5 million people.

The claim indicates that the hacker grabbed the database from Hospital Nacional Cayetano Heredia (HNCH). The hospital is a major public healthcare institution in Lima, Peru.

According to the account’s report, the dataset in circulation seemingly contains different information like personal identifiers & clinical information of the patients.

Alleged Database Contains Identity & Clinical Information

From the reports, the threat actor claims the database has many categories of information that could connect identifiable individuals to their histories in the healthcare facility.

These include Peru’s Documento Nacional de Identidad (DNI) numbers, names, and dates of birth. Also, there are residential addresses belonging to patients, their telephone numbers & email addresses.

The alleged records also cover more than the ordinary contact details. From the information Dark Web Intelligence shared,  the dataset also has medical record numbers, and triage details. It also has chief complaints, codes of diagnosis & insurance affiliation numbers.

If these are authentic, combining these fields could make the information very sensitive for the patient. Hackers could use the national identity numbers and contact details to identify an individual. They could also use their medical record numbers & clinical entries to unveil any interactions they had with the healthcare services.

The figure of 14.8 million records in the report does not mean the people who own the records are up to 14.8 million. One individual may have many entries that accumulated across consultations, diagnoses, triage assessments or other hospital encounters.

Although the threat actor claimed that the data belongs to approximately 2.5 million people, there is no verification yet to confirm such a claim. Also, there is nothing to verify the age & completeness of the records.

Medical Fraud & Targeted Scams As Potential Risks of such a Hack

The alleged combination of identity information and medical details is an issue of concern. This is because threat actors can misuse the data if the claims prove genuine. The criminals holding such information could potentially use it to make their fraudulent communications appear true to their targets. 

It will even be easy for them to impersonate patients or make use of personal details in identity-related schemes. One thing to be concerned about is targeted social engineering. A scammer who knows a person’s name, contact information & details of a hospital visit can easily create a convincing message.

When they send such a message posing as hospital staff, an insurer or another healthcare-related service, the target will believe them. The threat actors could use such messages to ask for more personal information, account credentials or even payments under false pretences.

With the report showing insurance affiliation numbers, the risk of impersonation or attempts to exploit healthcare-related administrative processes is high.

Meanwhile, such an exposure of clinical details could make the patients uncomfortable as their  privacy is gone. And it is even more alarming where their diagnoses or medical complaints are not for the public’s knowledge.

But note that these are consequences that might arise but not confirmed outcomes of this particular incident.

Hospital Response and Verification Remain Key Questions

As at the time of the X post, there is no verified evidence that the database is authentic. Also, there is information that the criminals have used the records to commit fraud. The first question requiring an answer is whether the database genuinely belongs to Hospital Nacional Cayetano Heredia.

A claim or post by a threat actor alone does not prove that there was a successful hit on the systems of the healthcare institution. In a separate case, the Medusa ransomware gang also claimed attacks on a US hospital and a New Jersey county, highlighting the cybersecurity threats facing healthcare institutions and public services.

To verify such a claim, there must be reliable evidence showing the origin of the dataset.  Also, there should be proof of its contents & the circumstances under which the threat actor collected the information.

A visit to the official website of the hospital shows HNCH as a public healthcare institution with links to Peru’s Ministry of Health. The information on the site shows the institution has a responsibility to secure patients information. It is also responsible for maintaining backups & protecting sensitive hospital information.

Moreover, Peru’s Personal Data Protection Law, Law No. 29733, shows a clear legal framework for protecting personal information. As of the information in the report, the alleged leak has not been confirmed by another independent body. And there is no official confirmation from the hospital yet.

To know if the hack is true, there needs to be an institutional statement, or an investigation by the relevant authorities. Also, a credible technical analysis that shows the authenticity, scope & source of the database will help too.

If the claims become true later, this exposure could become one of the most significant health-data incidents of the year in Peru.

However, the authenticity & timeframe of the dataset is still not verified. Besides, the records in the report could be old and not information from the new breach. Nevertheless, patients of this hospital should be careful especially when they receive calls out of the blue.

They should be alert when emails or text messages that mention their hospital visits or medical details come to them. Also, they should check any request they receive through official channels they collected themselves.

This is because scammers could use the information in the dataset to make fraudulent communications appear real. Such a thing might mean that they will succeed in carrying out identity theft, medical fraud & targeted scams.