Qilin has added Sanatorio Modelo de Caseros, a private hospital in Greater Buenos Aires, Argentina, to its dark web leak site. Threat trackers logged the claim on August 26, with the group saying it stole internal data from the facility.
The hospital operates in the Caseros district of Tres de Febrero, part of the densely populated corridor west of Buenos Aires. Qilin has claimed a growing list of healthcare victims, including Cyprus drugmaker Medochemie and pharma development firm Crystal Pharmatech, and has been tied to VPN-focused intrusion campaigns against hospitals.
The listing does not yet include proof of the stolen files, and the claim remains unconfirmed. Ransomware.live and GalaxyWarden both recorded the entry on August 26.
For smaller private facilities across Latin America, the claim is a reminder that regional hospitals remain a primary ransomware target. Even an unverified leak listing can damage patient trust and trigger insurance and regulatory review, so hospitals should audit remote access, verify backups, and monitor credential exposure while the claim is investigated.
