VULNpocalypse
LowBreach / campaignMonitoring

The Gentlemen ransomware group claims Mato Grosso state health department

The Gentlemen ransomware group claims Mato Grosso’s state health department on its leak site, unconfirmed, so watch for an official statement.

Published
Exploitation
No, not confirmed, the only evidence is a leak-site listing recorded by RansomLook

What happened

The ransomware tracker RansomLook reports that the group known as The Gentlemen added “Secretaria de Estado de Saúde” to its leak site in a post dated 2026-11-02. According to RansomLook, the listing names the domain saude.mt.gov.br and describes the organisation as the state health department of Mato Grosso, Brazil.

This is a claim by the group, not a confirmed breach. The sources do not include any statement from the health department, and they contain no independent verification of the claim. The following details are not confirmed:

  • Whether any data was taken or any systems were encrypted.
  • How much data is involved. The RansomLook excerpt gives no data volume for this listing.
  • How the group got in.
  • When any intrusion happened.

RansomLook lists the group’s leak site and chat server as down (RansomLook).

Am I affected?

The sources do not say. They name no affected individuals, partners or systems beyond the organisation itself. Whether patient, staff or supplier data is involved is not confirmed.

What to do now

  1. Watch for an official statement from the Mato Grosso state health department before acting on the claim.
  2. If you are a supplier or partner with integrations or shared accounts, contact the department through known channels and ask whether the incident is confirmed.
  3. Be wary of unexpected messages that refer to this claim or to the department, because the content of any leak is not confirmed.

Sources