Children’s Memorial Hospital Data Breach

Children’s Memorial Hospital, a healthcare provider located in the Philippines, has been listed by the Safepay ransomware group on September 28, 2026. This listing is of particular interest due to its divergence from the typical targeting patterns of the Safepay threat actor. While healthcare organizations are a known target for ransomware groups due to the sensitive nature of patient data, the relocation of this attack to the Asia-Pacific region represents a notable shift. Safepay has historically focused its operations in geographies such as the United States, Switzerland, and Spain. The inclusion of a Philippine hospital suggests a potential expansion of their operational reach, possibly through the acquisition of access from an Initial Access Broker (IAB) specializing in Southeast Asian markets, or a deliberate strategic expansion. Over the past 60 days, Safepay has claimed approximately 40 victims, with Manufacturing and Agriculture sectors being more frequently targeted than Healthcare. This specific listing indicates a move beyond their typical geographic and sectoral preferences.

A domain query was performed, which returned no records. This result is considered inconclusive, as healthcare infrastructure in the Philippines often utilizes platforms that may not be present in standard Western stealer-log datasets. The absence of indexed credentials does not definitively confirm that the organization is unaffected by credential compromise or that an intrusion has not occurred. The potential implications of this listing on Safepay’s dark web portal are significant, particularly given the sensitive nature of a pediatric hospital’s operations. Even without independent verification, such claims warrant immediate internal security review. The unusual geographic focus of this attack, moving beyond Safepay’s core operational areas, raises questions about potential new access vectors or a deliberate expansion strategy by

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.