MyM ODONTOCLINICA S.A Data Breach

Emperador ransomware group listed MyM ODONTOCLINICA S.A, a Brazilian dental and healthcare services provider, on its leak portal on October 14, 2026. SOCRadar’s telemetry identified severe prior credential exposure for the company’s domain, mymodontoclinica[.]com[.]py. This exposure, spanning October 2025 to May 2026, provided a significant window for attackers to compromise the organization’s infrastructure. The nature of MyM ODONTOCLINICA’s operations, dealing with sensitive patient data, could attract ransomware actors seeking leverage through data exfiltration. In the 60 days leading up to this listing, Emperador claimed 39 other victims, primarily in the Manufacturing, Transportation, and Government and Defense sectors. The group’s most frequently targeted countries are Brazil, the United States, and Argentina. Recent victims include CMC AUDITORES SRL (Argentina), METROCOLOR S.A. (Peru), PANCARIBBEAN LOGISTICS GROUP (Trinidad and Tobago), and Imperial Diamond Jewellery (Hong Kong). While MyM ODONTOCLINICA’s presence in the healthcare sector deviates from Emperador’s typical focus on manufacturing and logistics, the ransomware group often targets industries with high data sensitivity to maximize extortion leverage.

SOCRadar’s stealer-log telemetry revealed three records associated with mymodontoclinica[.]com[.]py, spanning from October 2025 to May 2026. One corporate credential was found on the organization’s own WordPress administrative login endpoint. A second corporate email credential was identified on a third-party cPanel hosting control panel, which is critical for managing DNS configuration, email routing, and backup operations. The third record, associated with the root domain, includes a username that cannot be definitively linked to an employee based solely on the email domain, potentially representing a compromised customer account or attacker persistence. The exposure of cPanel credentials is particularly concerning, as it provides attackers with the ability to perform actions such as DNS hijacking, email interception, and backup deletion. This sequence of events can be used to eliminate recovery options before deploying ransomware. The WordPress admin credential offers a direct pathway for content management and, depending on the configuration, server-side execution. The seven-month period of credential exposure suggests a prolonged opportunity for threat actors to exploit these vulnerabilities. While the stealer-log evidence does not definitively confirm that Emperador utilized these specific credentials, the observed pattern aligns with typical ransomware kill chains. Information brokers often source credential logs, validate access to hosting control panels and content management systems, and then sell or use this access to disrupt backups and deploy ransomware. Immediate priorities for MyM ODONTOCLINICA include rotating WordPress and cPanel credentials, auditing DNS records for any unauthorized modifications, and verifying the integrity of backups before attempting any restoration.