Brazil's data protection authority, the Agência Nacional de Proteção de Dados (ANPD), has opened a formal sanction proceeding against Instituto Saúde e Cidadania (Isac), a social organization headquartered in Brasília that manages public healthcare units across Goiás, Rio Grande do Sul, Bahia, Alagoas, Piauí and Tocantins. The regulator announced the case on 8 July 2026, following a ransomware incident that Isac itself reported to the agency. Per the ANPD's own announcement, the incident affected approximately 500,000 patient records, of which roughly 78,772 belonged to children and adolescents and 47,921 to elderly patients. Those three figures are consistent across every source reviewed, including Valor Econômico, Estadão, CISO Advisor, TI Inside and SearchInform. Isac, for its part, publicly disputes that any leak occurred at all.
What Happened
The ANPD's account is the anchor here, and it is the account most other coverage derives from. According to the regulator, Isac suffered a ransomware cyberattack in which data was encrypted and rendered inaccessible. Isac notified the ANPD, which opened a preliminary fact-finding process that has now escalated into a full administrative sanction proceeding.
Timing is one point where the reporting does not line up cleanly. The ANPD states the security incident occurred in 2025, and Estadão and Valor both describe it as having happened "last year," consistent with a 2025 event disclosed in mid-2026. CiberLATAM, however, writes that "Brazilian press reports pointed to a ransomware attack against ISAC in July 2026." That later date appears to conflate the announcement of the sanction proceeding with the attack itself. Weight the ANPD's 2025 date.
The identity of the entity is a second point of divergence. The ANPD, Estadão, Valor, SearchInform and TI Inside all describe Isac as a social organization (organização social) that operates public health facilities under state contracts. A separate CiberLATAM piece instead describes "Isac Tecnologia em Saúde" as a clinic and hospital management system provider, and reports that the ANPD is weighing shared responsibility between the technology company and the healthcare institutions that contract it. That framing is not corroborated by the regulator's own statement or by the Brazilian financial and general press, and should be treated as an outlier attribution unless the ANPD confirms a vendor dimension. The same outlet notes that O Jornal Extra reported a parallel local review in Alagoas.
No threat actor, ransomware family, affiliate or leak-site posting is named in any source. Nobody has publicly claimed the attack.
One caution for readers scanning headlines: TI Inside's English-language edition is titled as affecting "500 patients," and repeats "500 patient records" in the body. This is a translation artifact of the Portuguese "500 mil" (500 thousand). Its own figures for minors and elderly patients match the 500,000 total.
What Was Taken
The ANPD describes the affected records as containing both identifying personal data and sensitive health data under the LGPD's heightened category:
- Names and dates of birth
- Examination and test histories
- Medical records and charts (prontuários)
- Prescriptions
- Outpatient visit records
- Hospitalization records
- Diagnoses
- Procedures performed
Volume is consistently reported at approximately 500,000 records. TI Inside explicitly flags the figure as an approximation, and the ANPD uses "cerca de" (about) throughout, so treat 500,000 as a rounded institutional estimate rather than a reconciled count.
Whether any of this data actually left Isac's environment is genuinely contested. The ANPD says that when it questioned Isac about real-world impact, the organization argued there was no relevant risk or damage to data subjects because attackers had allegedly accessed only administrative information and databases tied to already-terminated contracts. The regulator's position, reported identically by Valor, CISO Advisor and SearchInform, is that Isac provided no technical evidence to substantiate that claim.
Isac has gone further in press statements. In a note to Estadão, the institute said no data leak occurred at all, that the cyberattack resulted in temporary system unavailability, and that its analyses "did not identify evidence of extraction, exfiltration or improper disclosure of personal data." Valor separately quotes Isac saying it is "taking all necessary measures to investigate what occurred, mitigate impacts and prevent new occurrences."
So the accounts genuinely differ on the central question. The regulator and the press describe a leak of 500,000 patients' data; the victim describes an availability-only ransomware event with no proven exfiltration and has not produced forensic evidence either way. Both positions are on the record and neither has been independently verified.
Why It Matters
The exposure profile is the aggravating factor. Roughly one in four of the affected records belongs to a minor (78,772) or an elderly patient (47,921), two populations with the least capacity to detect or remediate downstream fraud, and whose medical histories carry lifetime sensitivity. Estadão quotes the regulator's framing directly: anyone handling health data must adopt the most rigorous possible information security model, because on the ANPD's risk scale, health data sits near the very top, comparable to financial data.
The proceeding is also notable for what it targets. The ANPD is not only investigating whether Isac failed to implement adequate technical and administrative safeguards. Per the regulator, the case covers four distinct alleged LGPD violations:
- Failure to adopt security, technical and administrative measures capable of protecting personal data
- Failure to adequately notify the individuals affected by the incident
- Failure to make available information about the organization's data protection officer (encarregado)
- Violation of the principles of prevention and of accountability
That second and third item matter for anyone modelling regulatory exposure. The ANPD says Isac did not notify affected data subjects individually, limiting itself to publishing a general notice. In other words, roughly half the case is about post-incident conduct, not about the intrusion. Self-reporting the breach did not insulate Isac from enforcement.
On potential penalties, CiberLATAM cites O Globo's reporting that Isac has 10 business days to mount a defense and that sanctions could range from a warning to a fine of up to 2% of revenue, up to suspension or prohibition of personal data processing. TI Inside, quoting IT and cybersecurity lawyer Bruno Fuentes, describes a comparable range under the LGPD: warnings, administrative fines, blocking or deletion of irregularly processed data, and in more serious cases restrictions on processing. Fuentes cautions against premature conclusions while the proceeding is open, but flags a second-order risk that is easy to overlook: repercussions for contracts signed with the public administration, particularly if data protection and information security obligations were breached. For a social organization whose revenue comes from state health contracts, that contractual exposure may exceed the fine.
The Attack Technique
Initial access vector is unknown. No source identifies the intrusion path, the ransomware strain, the dwell time, or the date of encryption beyond the year. The ANPD and the Brazilian press describe only the outcome: a ransomware attack in which data was "sequestrado" and rendered inaccessible.
What can be inferred from the dispute itself is limited but useful. Isac's defense rests on the claim that intruders touched only administrative systems and databases for expired contracts, which implies a segmentation argument the organization has not been able to evidence. The ANPD's counterpoint is that preliminary findings indicate Isac did not have safeguards in place to keep the data secure and did not adopt adequate post-incident procedures. An operator unable to produce forensic proof of what attackers reached is, in practice, an operator without sufficient logging and telemetry, which is itself the finding.
Treat any claim about the specific malware, actor or entry point circulating about this incident as unsourced until the ANPD proceeding produces a public record.
What Organizations Should Do
- Instrument for exfiltration proof, not just recovery. Isac's entire defense collapsed on its inability to demonstrate what attackers accessed. Ensure egress monitoring, database access auditing and immutable log retention are sufficient that you could answer "what left the network" with evidence, months after the fact.
- Segment clinical data from administrative systems, and be able to prove it. The "attackers only reached administrative databases" argument is only credible with enforced network and identity boundaries plus access logs that corroborate it.
- Delete or isolate data from terminated contracts. Records tied to expired contracts were still on reachable systems. Retention schedules with actual enforcement remove entire categories of records from breach scope before an incident happens.
- Pre-build individual notification capability. Under the LGPD, as under GDPR, a general public notice is not a substitute for notifying affected data subjects when risk warrants it. Half the ANPD's case concerns communication failures. Maintain the contact data and templated workflow needed to reach affected individuals at scale within regulatory deadlines.
- Publish and staff your DPO contact. Failure to make encarregado information available is a standalone alleged violation here. This is a trivially avoidable finding that costs nothing to fix in advance.
- Apply the highest tier of controls to health data, especially records of minors. MFA everywhere, phishing-resistant where possible, least-privilege access to medical records, encryption at rest with keys held outside the application tier, and tested offline backups.
- Extend all of the above to contracted operators. If your health system delegates facility management or record-keeping to a third-party organization, that operator's control failures become your patients' breach. Contractually require incident evidence preservation and notification support, and audit against it.
Sources: ANPD investiga Isac por vazamento de dados de 500 mil pacientes | ANPD instaura processo de sanção contra OS por falha na proteção de... | ANPD investigates ISAC after data leak — CiberLATAM | Brazil ANPD probes Isac ransomware attack — CiberLATAM | Brazil Investigates Security Failures in Breach Affecting 500,000 P... | Ransomware attack against Isac results in data breach affecting 500... | Ataque hacker ‘sequestra’ dados de 500 mil pacientes e empresa é al... | Ataque cibernético vaza dados de 500 mil pacientes da rede pública...