NUEVA EPS, Colombia’s largest regional health-promoting entity, is the subject of an alleged data incident that has drawn attention to the country’s health information handling. On 4 October, a user on a hacking forum claimed to have posted a database associated with Nueva EPS and to be seeking a US$15 million ransom in Bitcoin.
The post also described a dataset believed to cover more than 11 million affiliates, including sensitive identifiers, contact details, and a broad range of health, lifestyle and medical information. DataBreaches[.]net says the alleged data counts total 11,239,741 records, with headers and a sample of records provided by the threat actor.
Nueva EPS issued a statement via X, saying it became aware of the purported posting, activated its incident-response protocol, and formed a specialised technology, cybersecurity and data-protection team to investigate. The entity asserted that so far no evidence of unauthorised access to its systems has been identified and that verifications continue to determine the veracity and origin of the published material.
DataBreaches[.]net, which contacted Nueva EPS, reports that the threat actor claimed to have gained access a week earlier through compromised credentials and to have exfiltrated data without encryption, while maintaining that Nueva EPS has not confirmed or denied these specifics.
The situation remains unresolved as authorities and the affected entity assess the authenticity and scope of the breach. The report notes that the actor identified themselves by the moniker associated with the incident and that the group claimed a ransom demand of US$15 million. Nueva EPS says it will provide updates in a timely manner if new information emerges.