The extortion group tracked as The Gentlemen has listed Hospital de la Santa Creu i Sant Pau on its leak site, according to dark web trackers that logged the post on October 3. The Barcelona institution is one of Europe’s oldest and largest academic hospitals.
Founded in 1401, the hospital is a UNESCO World Heritage Site and a major teaching and research center. It runs about 600 beds and 25 operating rooms and serves more than 400,000 patients a year, with roughly 4,965 staff on an annual budget near EUR 490M. Its research arm, IR Sant Pau, employs more than 1,600 people and runs hundreds of active clinical trials.
The claim published no data samples, volume or deadline, and the hospital has not confirmed a breach. The Gentlemen has spent recent weeks posting healthcare and other victims to its page.
For European providers, the listing is a reminder that academic medical centers carry a blend of risk that commercial hospitals do not: large patient volumes, sprawling research data and clinical trial records that can carry both privacy and competitive value. A research-heavy campus widens the attack surface well beyond the bedside.
Defenders should treat a leak-site mention as an unverified signal, not a verdict, and use it to pressure test segmentation between clinical systems and research networks, the seam that too often goes unmanaged.
