Krybit, the extortion gang that has cycled through several healthcare targets this summer, has listed an Egyptian private hospital on its leak site. Trackers logged seashellhospital.com, the domain of Seashell Hospital in New Cairo, on September 1, with the group claiming it holds internal data but publishing no files or victim counts so far.
Seashell Hospital describes itself as a comprehensive private facility in the New Cairo district offering multidisciplinary care. The listing carries no data samples or volume figures, and the hospital has not commented publicly, leaving the claim unverified for now.
Krybit spent late August posting medical organizations, including an Indian cancer treatment platform, a pharmaceutical contract research firm, and a Brazilian eye hospital in a single day. The gang’s pattern in those cases involved leak-site postings that escalated to data publication when victims did not engage.
For Egyptian and regional healthcare providers, the episode underscores how geographically dispersed extortion operations have become, with gangs treating hospitals in emerging markets as softer targets than their US counterparts. Patients of the hospital should wait for an official disclosure before acting. Security teams at peer hospitals should review remote access exposure, particularly VPN appliances: the tracker record for this domain flags a FortiOS SSL-VPN credential exposure tied to the 2022 FortiBleed leak, a reminder that old VPN flaws keep surfacing in hospital footprints.
