Hospital Sírio-Libanês confirms cyberattack on internal reporting systems

Hospital Sírio-Libanês has confirmed a cyberattack that occurred on September 21, potentially exposing personal and sensitive data related to its social projects. The institution stated that its general patient database was not affected, but an internal reporting system was compromised.

The potentially accessed information includes registration and contact details such as names, ID numbers (RG and CPF), addresses, emails, and phone numbers. Sensitive data, including health information, race, or ethnicity, may also have been involved. The cybercriminal group Seven Deadly Sins (7DS) has claimed responsibility for the attack, allegedly extracting approximately 1,600 CSV files containing over 10 million lines of data.

Reports suggest the breach may have targeted a server used by Mangará Digital, an open-source telehealth platform developed by the hospital to connect health professionals and patients, particularly through initiatives involving the Unified Health System (SUS).

The hospital has notified the National Data Protection Authority (ANPD) and the Federal Police. While technical investigations have not yet identified evidence of public leaks or misuse, the institution is communicating individually with potentially affected individuals and has implemented security measures, including environment isolation and credential resets. Medical services and assistance systems remain operational.