Seashell Hospital Data Breach

Krybit ransomware claimed Seashell Hospital as a victim on September 1, 2026, as part of their September 2026 activity. This listing was identified by SOCRadar’s Dark Web Monitoring. Seashell Hospital is a multi-specialty healthcare facility in India, offering a range of inpatient, outpatient, and diagnostic services. Healthcare organizations are often targeted due to the sensitive nature of patient data and the critical services they provide, making them more likely to pay ransoms to avoid disruption. The krybit group has been active, claiming 58 other victims in the preceding 60 days. Their typical targets include Professional Services, Other, and Technology sectors. The group shows a geographical concentration in India, Thailand, and Brazil, aligning with Seashell Hospital’s location in India. Within India, other healthcare entities previously listed by krybit include Jindal Life Science Private Limited, Karkinos Healthcare Private Limited, and Labindia Instruments Pvt. Ltd. This pattern suggests that Seashell Hospital fits the group’s established targeting profile for both industry and geography.

A query of stealer-log data for seashellhospital[.]com revealed significant findings, with five records identified spanning from October 2025 through August 2026. Specifically, the WordPress admin endpoint (seashellhospital[.]com/wp-login.php) showed three records from June through August 2026. These records utilized the same masked admin username and indicated no credential rotation during this period. This persistent, unrotated credential is a significant initial access vector. Additionally, one employee credential record was found associated with Vezeeta, a third-party healthcare appointment platform, suggesting a broader exposure beyond the hospital’s direct infrastructure. The presence of unrotated WordPress admin credentials for three months presents a clear pathway for attackers. Such access allows for the installation of malicious plugins, pivoting into the hosting environment, or establishing a webshell for further lateral movement within the network. The combination of compromised WordPress admin credentials and an employee account from a third-party healthcare platform indicates a substantial risk of corporate intrusion. Attackers gaining access through these compromised credentials could exploit this access to deploy ransomware or engage in further malicious activities. It is critical to rotate WordPress admin credentials immediately and conduct a thorough review of all admin activity logs from June 2026 onwards.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.