Incident Overview

A threat actor operating under the handle NyxarGroup is selling 1.8 million records from Maple Respiratory Colombia, a Colombian healthcare provider specializing in respiratory care. The data is being offered for $400 with escrow accepted, and a sample has been provided. Contact is handled via SimpleX messenger.

The breach reportedly involves two separate databases. The first, labeled "users," contains patient contact and identity information including patient names, phone numbers, email addresses, identification numbers, and secondary phone numbers. The second database, labeled "citas" (appointments), contains what the actor describes as patients' entire medical history, with fields covering facility location (sede), treating professional, appointment dates, times, service types, patient names, phone numbers, email addresses, appointment types, and appointment statuses.

The combination of patient identity data with full medical appointment histories makes this a particularly sensitive breach. The appointment records could reveal the types of respiratory conditions patients are being treated for, the frequency of their visits, and which specialists they see, all of which constitutes protected health information that could be used for targeted scams or discrimination.