A Ragnar Locker leak-site listing for Azienda Ospedaliera di Alessandria (AOAL), a public hospital authority in Piedmont, Italy, is being reported again. The attack itself is not new. The intrusion happened on the night of 19 to 20 December 2022, and the group posted its data sample on 28 December 2022. The hospital has acknowledged the attack. Italy's data protection authority, the Garante per la protezione dei dati personali, later fined it €25,000. Several things are still unconfirmed: how much data was actually stolen, the claim that "hundreds of thousands" of people's records are involved, and whether hospital systems were encrypted. Accounts differ on these points.
What Happened
Italian incident tracker BoNet says many computers on the hospital's network displayed a Ragnar Locker message during the night of 19 to 20 December 2022. The message said the group had copied nearly a terabyte of data and would sell it unless the hospital made contact within three days.
The hospital published an account on its website on 23 January 2023, alongside an article by the head of its IT service, and investigated together with ACN, Italy's National Cybersecurity Agency. BoNet summarises that account as follows:
- The attackers got into shared network folders. They did not reach the clinical or administrative applications.
- Patient services kept running.
- The hospital could not rule out that health data saved in those shared folders had been taken.
Siberpol says Ragnar Locker posted the hospital on its leak site on 28 December 2022 with a data "preview". Siberpol's write-up appeared only this month (November 2026), which is why the listing looks new. BoNet closed its own file on the case on 5 November 2026 after more than eight months with no new developments.
Ragnar Locker's infrastructure was taken down in a Europol-coordinated operation in October 2023. The listing is a historical record, not a fresh threat from an active group.
What Was Taken
The numbers do not line up:
- Total volume: Siberpol says the group claimed more than 1 TB. BoNet says the ransom note claimed "nearly a terabyte".
- Sample: Siberpol says the group published a 37 GB sample and called it 5% of the total. That ratio works out to roughly 740 GB, which is below the 1 TB figure. Both numbers come from the attackers, and neither has been checked independently.
- People affected: The "hundreds of thousands" of personal records figure appears only in Siberpol's headline. The hospital has not confirmed it, and no regulator figure has been published.
- Data types: Siberpol describes the sample as a wide range of confidential files. The hospital's position, as BoNet reports it, is that only shared folders were affected and that health data stored there may have been exposed.
BoNet also says it is still unknown whether the full dataset was ever published or sold.
Why It Matters
The regulator's findings are the most useful part of this case. Punto Informatico reported in December 2024 that the Garante fined the hospital €25,000. The deficiencies it cited included no multi-factor authentication (MFA) on the VPN and no separation between networks. Those are basic controls. Without them, one stolen VPN login can give an attacker access to every shared drive in the organisation.
Healthcare keeps running into the same problems. The HIPAA Journal has reported a Metabase zero-day exploited against Dorsata, affecting 58,249 patients, and an insider-access case at Sutherland Healthcare Solutions. Hoag Memorial Hospital Presbyterian reported network intrusions in October 2026. Medical Daily notes that Hoag has not said how many people were affected or what caused the incident. In Italy, Sardiniapost reports that someone sent unauthorised emails to around 300 patients of the Brotzu hospital's anticoagulation centre, using its patient database and official mailbox. In the same city as AOAL, Siberpol lists the local Confcommercio office as a Quantum ransomware victim from April 2022, although the group published no evidence.
Old leak-site listings also tend to get recirculated by data brokers. Patients from 2022 should assume their data may still be circulating.
The Attack Technique
Neither the hospital nor the Garante has described the exact way the attackers got in. The Garante's findings point to remote access as the most likely route: a VPN protected only by a password, plus a flat network that left shared storage reachable. Siberpol says Ragnar Locker typically used double extortion, meaning it encrypted systems and also threatened to leak data. BoNet notes that it is still disputed whether AOAL's systems were actually encrypted. The ransom message appearing on workstations does not settle that question.
For context on how ransomware intrusions have developed since 2022, Kaspersky's Securelist describes Storm-2603 exploiting SharePoint flaws CVE-2025-53770 and CVE-2025-53771. The group ran its access tooling entirely in memory inside the IIS worker process (w3wp.exe), attempted to disable EDR, and then tried to deploy ransomware. Internet-facing services remain the main way in.
What Organizations Should Do
- Require phishing-resistant MFA on all remote access. That includes the VPN, remote desktop gateways, and vendor access. This is the specific control the Garante found missing here.
- Segment the network. Shared file storage should not be reachable from every workstation or VPN session. Separate clinical, administrative, and user networks.
- Keep health data out of general shared folders. Audit file shares for patient data and move it into access-controlled clinical systems.
- Watch for large outbound transfers. Alert on unusual exfiltration volume. Hundreds of gigabytes leaving a hospital network should never go unnoticed.
- Patch and monitor internet-facing servers. This includes SharePoint and BI tools such as Metabase. Look for in-memory implants and attempts to tamper with EDR, not just files written to disk.
- Plan for listings to resurface. Keep breach records and patient notification material on file so you can respond quickly when an old leak-site listing circulates again.
Sources: Ragnar Locker ransomware group lists Hundred thousands of personal... | How to detect fileless attacks exploiting ToolShell: analyzing the... | Sutherland Healthcare Solutions; Hoag Memorial Hospital Presbyteria... | Metabase Zero-Day Exploited in Dorsata Data Breach Affecting 58,000... | Azienda Ospedaliera di Alessandria: intrusione nella rete e minacci... | Confcommercio - Alessandria - Home listed on Quantum ransomware lea... | Brotzu, mail sulla chiusura del Centro TAO getta nel panico i pazie... | Hoag Hospital Newport Beach Patients' Personal and Health Data May...