The Black X extortion group has added DomusVi to its leak site. DomusVi is one of Europe's largest elder-care and nursing-home operators, with more than 500 residences across France, Spain and Portugal. Black X says it holds data on DomusVi's clients and their primary contacts, including medical record numbers and bank account numbers. It has not said how many records it took or published a sample anyone has verified. DomusVi has not confirmed a new incident, and no regulator filing or national CERT statement has been published. Until that changes, treat this as an unverified claim by the attackers, not a confirmed breach.
What Happened
Accounts differ slightly on the timing. RansomLook, a tracker of leak-site listings, recorded the DomusVi entry at 18:25 UTC on November 9, according to mAlice.ai. HookPhish gives an attack date of 16:31 UTC on November 9 and a discovery time early on November 10. DeXpose and a ThreatMon alert cited by Undercode News give November 10 as the listing date. HIFY Radar reported the claim on November 9. The most likely explanation is that the listing went up late on November 9 UTC and spread through monitoring feeds overnight.
The listing names the Spanish domain domusvi.es and includes a negotiation chat ID. Several trackers reproduced the group's statement word for word.
DomusVi was not Black X's only listing that day. According to RansomLook data reported by mAlice.ai, the group also listed Court Square Group and the Spanish leisure company Forus Deporte y Ocio S.L. on November 9. That points to a burst of activity aimed partly at Spanish organisations.
Undercode News notes that DomusVi has been hit by ransomware before, involving the Hive group. It also stresses that nothing connects that earlier incident to the Black X claim. No one has yet established whether this data comes from a new intrusion, an older breach, a third-party supplier or a recycled dataset.
What Was Taken
Black X's statement, as reproduced by DeXpose and HookPhish, says: "We possess all the data for our clients and their primary contacts, including medical record numbers, first and last names, phone numbers, email addresses, physical addresses, and bank account numbers."
If the claim is true, the alleged dataset covers:
- Health identifiers: medical record numbers for residents
- Identity and contact details: full names, phone numbers, email and home addresses, for residents and for the family members or guardians listed as primary contacts
- Financial data: bank account numbers, probably linked to fee payments and direct debits
No source gives a record count or file volume. RansomLook's entry, according to mAlice.ai, does not say how much data the group claims or whether it has made a ransom demand. HIFY Radar and Undercode News both say no samples have been independently verified.
Why It Matters
Elder-care records connect three things that fraudsters find valuable: a vulnerable person, the relative who manages their affairs, and the bank account that pays for their care. HIFY Radar warns that the most likely harm is targeted fraud, such as fake care invoices, direct-debit changes and calls from people pretending to be the care home. A message that cites a resident's real medical record number and a family member's real bank details would be very convincing.
Healthcare data in Spain and France falls under GDPR as a special category. If DomusVi confirms a breach, it would need to notify the Spanish data protection authority (AEPD) and possibly France's CNIL within 72 hours of becoming aware of it. Watch for those filings. They will be the first reliable confirmation either way.
Even if this listing turns out to be inflated or recycled, the group has now published the DomusVi name together with the categories of data it claims. Scammers may use that alone as a pretext to contact families.
The Attack Technique
Black X has not said how it got in, and DomusVi has not said anything. The only technical claim comes from QPulse, which cites outside data:
- Hudson Rock reportedly found 413 compromised user accounts and 18 compromised third-party employee credentials linked to DomusVi.
- ParanoidLab reportedly found 1,238 passwords and 239 browser cookies tied to the company's domain.
QPulse concludes that infostealer malware "facilitated" the compromise and that stolen session cookies may have let the attackers get past authentication. No other outlet has reported these figures, and QPulse does not show a direct link between the leaked credentials and this intrusion. Infostealer exposure on this scale is common among large employers. It tells you about the risk, but it does not prove how the attackers got in. Still, stolen credentials and session tokens are among the most common ways ransomware crews gain initial access, so this is a reasonable line to investigate.
What Organizations Should Do
- Monitor for infostealer exposure. Check infostealer log feeds for staff and contractor credentials on a regular schedule. Reset passwords for any exposed accounts and revoke their active sessions, not just the password.
- Make stolen session cookies useless. Shorten session lifetimes for remote access and admin portals. Bind sessions to the device where possible, and require MFA again for sensitive actions.
- Bring third parties under your access controls. The 18 third-party credentials reported here are a reminder that contractors and agencies need the same MFA, conditional access and offboarding as your own staff.
- Warn residents' families before the fraudsters reach them. Care operators should tell families how invoices and bank-detail changes are actually communicated, and that any request to change payment details must be confirmed through a known phone number.
- Lock down bank-detail changes in finance. Require a callback and two-person approval before changing any direct-debit or payee account, and flag a sudden rise in change requests.
- Keep immutable offline backups and test restoring them. Data-theft extortion often comes with encryption. Care homes rely on resident records and medication schedules, so they cannot afford long outages.
Sources: Black X Ransomware Group Claims Data Exfiltration from DomusVi QPulse | Black X Ransomware Attack on DomusVi Exposes Sensitive Data - DeXpose | Black X claims theft of DomusVi elder-care… HIFY Radar | Black X Claims Theft of Sensitive Data From European Elder-Care Gia... | BlackX Claims DomusVi as New Victim in Latest Data Breach Allegatio... | Black X claims attacks on 3 organizations, including DomusVi · mAli... | DomusVi Data Breach: Black X Ransomware Claim (Nov 2026)