Instituto Ferrero de Neurología y Sueño Data Breach

Instituto Ferrero de Neurología y Sueño, a specialized healthcare institute in Argentina focusing on neurology and sleep disorders, was recently listed on the Kazu ransomware group’s leak site on August 23, 2026. This incident marks an expansion of Kazu’s targeting of the healthcare sector in Latin America, with Argentina now joining Mexico and Brazil as countries affected by this group’s activities. The organization’s focus on sensitive patient diagnostics and sleep medicine data makes it a high-value target. In the preceding 60 days, Kazu has claimed approximately nine victims, exclusively targeting the healthcare industry. While Mexico, Brazil, and the United States are Kazu’s most frequently targeted countries, Argentina’s inclusion signifies a deliberate geographic expansion. Other healthcare entities listed by Kazu during this period include ConsultorioMovil and Centro Médico Especializado OSI in Mexico, Meducar in Brazil, and Dr. Akbar Niazi Teaching Hospital in Pakistan. The specific nature of Instituto Ferrero’s services likely contributes to the attractiveness of this listing due to the sensitive patient data it holds.

A query against SOCRadar’s stealer-log telemetry for the domain ifn.com.ar returned no records. However, it is crucial to note that this negative result does not confirm the organization is unaffected. The queried sample was paginated, and credentials could exist under alternate corporate domains or utilize personal email aliases. Furthermore, any records may have been used and rotated prior to indexing, or may reside in data feeds not included in this specific query. Infostealer-harvested credentials are a primary initial access vector for many ransomware operations. While direct stealer-log evidence was not found for ifn.com.ar in this instance, the absence of such evidence in a limited sample does not rule out a compromise. Kazu, like many ransomware groups, has been observed to gain access through various means, including phishing, exploiting exposed VPN appliances, and utilizing previously compromised credentials. Therefore, organizations listed by such groups are advised to treat the listing as a significant indicator of potential compromise. Affected organizations should maintain vigilance by continuing dark web and stealer-log monitoring, conducting proactive credential hygiene checks, rotating passwords, and reviewing multi-factor authentication configurations. It is also recommended to monitor activity on other corporate domains, as well as review logs for Microsoft 365, VPNs, and remote access portals.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.