Cyber Attack Exposes Data of 500,000 Patients in Brazil's Health Sector

A cyber attack on the Instituto Saúde e Cidadania (Isac) has compromised the data of approximately 500,000 patients across six Brazilian states, including sensitive information of children and the elderly. The attack, identified as ransomware, occurred in 2025 and has led to an investigation by the Agência Nacional de Proteção de Dados (ANPD) for potential violations of the Lei Geral de Proteção de Dados (LGPD). Affected data includes personal identification and health records, such as medical histories and diagnoses. The Isac claims no significant data leakage occurred and that systems were restored without loss, but the ANPD has raised concerns over inadequate security measures and insufficient communication with affected individuals. The investigation is ongoing, with no penalties imposed as of now.

Key Points: • A ransomware attack compromised data of 500,000 patients managed by Isac. • The ANPD is investigating Isac for potential violations of data protection laws. • Isac claims no significant data was leaked, but the ANPD disputes this assertion.