Delhi Heart & Lung Institute Data Breach

Delhi Heart & Lung Institute, a healthcare organization based in India, has been listed as a victim on the Krybit ransomware group’s dark web portal, published on July 22, 2026. The listing was identified through SOCRadar’s Dark Web Monitoring service. The institute operates in the healthcare space, a sector whose patient-facing systems and long data-retention requirements make it a recurring focus of dark web leak activity. Its listing adds an Indian healthcare entry to a Krybit victim population that has skewed toward technology and business services. In the 60 days prior to this listing, Krybit has claimed 31 other victims across its leak portal. The group has shown a strong targeting pattern in the technology, business services, and financial services sectors. Geographically, its victims are concentrated in Germany, India, and Taiwan. Other recent Krybit listings that overlap with Delhi Heart & Lung Institute’s profile — Indian organizations or healthcare and insurance-adjacent entities — include Tulip Mediworld Hospital, Eurohold Bulgaria AD, Euroins Insurance Company AD, and Hôpital Catholique Saint Joseph Moscati. The institute diverges from the group’s dominant technology lean but aligns with its established Indian footprint and its intermittent healthcare targeting.

Initial-access correlation against SOCRadar’s stealer-log telemetry surfaced only a single, limited record for the dhli.in domain in the queried slice. That record is a lone credential pair whose username is masked and does not clearly resolve to a corporate mailbox, so it is more consistent with an external user or customer account than with direct employee compromise; the dominant profile is customer account-takeover / supplier risk rather than internal intrusion. No high-value identity, mail, or VPN endpoints were observed, and the freshness window is confined to a single day in mid-July 2026. A single-record result should be read cautiously — it neither confirms a corporate foothold nor rules one out, given the paginated nature of the sample. For ransomware groups such as Krybit, infostealer-harvested credentials are a well-documented initial access vector: operators or initial access brokers source fresh logs from underground marketplaces, validate the corporate credentials, and use them to log into Microsoft 365, VPN, or remote-access portals before deploying ransomware. The limited evidence here does not confirm that these credentials were used by Krybit, nor does it establish an internal foothold; the single external-looking record is better treated as a monitoring lead than as an initial-access finding. CTI teams should continue tracking the domain for corporate-credential exposure and maintain proactive credential-hygiene checks rather than drawing conclusions from a thin sample.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.