Skip to content
Leak-site post naming Unimed do Brasil, captured by ThreatCluster

Unimed do Brasil

sarcoma

Ransomware leak-site victim intelligence

Data size
2,8 TB Archive
Files
27
Views
67,868
Posted
Oct 15, 2025
Country
Brazil
Industry
Insurance

Summary

Written by ThreatClusterfrom victim profile, leak post

Sarcoma claims to have published a 2,8 TB archive from Unimed do Brasil (domain unimed.coop.br). Victim profile indicates the organization is an insurance provider in Brazil. The leak post states the publication status as published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

Unimed Pelotas is a comprehensive health service center located in Pelotas, Brazil, providing a wide range of medical services and assistance. They offer client-friendly features such as an application for convenience, a doctor search guide, and online medical consultations for both adults and children. The organization also emphasizes community involvement through various programs, including health and sustainability initiatives. Their target audience includes individuals seeking health insurance and medical services tailored to their needs.

File types seen
zip × 27
Sample files (27)
unimedrs.unimed_part001.zip
unimedrs.unimed_part002.zip
unimedrs.unimed_part003.zip
unimedrs.unimed_part004.zip
unimedrs.unimed_part005.zip
unimedrs.unimed_part006.zip
unimedrs.unimed_part007.zip
unimedrs.unimed_part008.zip
unimedrs.unimed_part009.zip
unimedrs.unimed_part010.zip
unimedrs.unimed_part011.zip
unimedrs.unimed_part012.zip
unimedrs.unimed_part013.zip
unimedrs.unimed_part014.zip
unimedrs.unimed_part015.zip
unimedrs.unimed_part016.zip
unimedrs.unimed_part017.zip
unimedrs.unimed_part018.zip
unimedrs.unimed_part019.zip
unimedrs.unimed_part020.zip
unimedrs.unimed_part021.zip
unimedrs.unimed_part022.zip
unimedrs.unimed_part023.zip
unimedrs.unimed_part024.zip
unimedrs.unimed_part025.zip
unimedrs.unimed_part026.zip
unimedrs.unimed_part027.zip

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture