Skip to content
Leak-site post naming Morula IVF, captured by ThreatCluster

Morula IVF

everest

Ransomware leak-site victim intelligence · EN

Data size
98.21 GB
Files
110,997
Views
427
Posted
Sep 25, 2026
Publication
Oct 5, 2026
Countdown
0 9 d : 1 8 h : 0 5 m : 5 9 8 s
Country
Indonesia
Industry
Healthcare / Fertility clinic

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Everest claims Morula IVF has 98.21 GB of data across 110,997 files and 16,775 folders, with substantive files totaling 84.23 GB (67,164 files) and installer-related data 13.98 GB (43,833 files). The leak page describes the data as including patient identities, IVF treatment data, PGT-A, consent, banking, and branch operations, with claimed categories spanning accounting/financial records, HR/payroll, patient and clinical records, reproductive-material records, legal/contractual records, banking/tax, and correspondence. The current state is countdown to publication, with the page identifying Morula IVF (domain morulaivf.co.id, Indonesia) as the victim and noting Power BI as a platform referenced on the leak page.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
morulaivf.co.id
Platforms
Power BI

What was taken

Executive summary and data-repository details for Morula IVF: 98.21 GB across 110,997 files and 16,775 folders; substantive files 67,164 (84.23 GB); installer-related 43,833 (13.98 GB); coverage includes patient identities, IVF treatment data, PGT-A, consent, banking, and branch operations.

Data categories
Accounting and financial recordsAudit, compliance and due diligenceBanking, payments and financingTax and fiscal recordsLegal and contractual recordsHR, payroll and staffPatient and clinical recordsReproductive-material recordsCorrespondence and mail
File types seen
csv × 1,250doc × 1,415eml × 63jpg × 1,337mp4 × 7msg × 13ods × 1pdf × 37,381png × 2,131xls × 1,539docx × 2,234pbix × 32pptx × 592xlsb × 124xlsx × 17,897

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

The files will be published after the timer counts down. The company still has t
The files will be published after the timer counts down. The company still has time to get in touch with us

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
onion leak page11 KB
Logo featuring three red circles above the word "Securitas" in dark blue text.
onion leak page574 KB
Logo featuring a stylized asterisk design in a light color on a dark background.
onion leak page7.4 KB
Logo featuring the letters "CEN" and "CENELEC," with a stylized design and a lightning bolt element.
onion leak page47 KB
The image features a logo with the word "UNIRITA" in bold pink letters, accompanied by a smiling face icon and text in Arabic and Japanese.
onion leak page161 KB
onion leak page6.5 KB
Logo featuring the text "morula IVF" in orange and gray, with a yellow flower-like design above it, all enclosed in a circular border.
onion leak page805 KB
Logo of Kingston Technology featuring a stylized red figure and the company name in black text.
onion leak page29 KB
Logo featuring the text "rx networks" with a stylized design, including a wireless signal icon.
onion leak page7.3 KB
The image features two stylized, glowing blue hands reaching towards a 3D representation of a DNA double helix in the center.
onion leak page57 KB