THREAT WATCH · September 28, 2026 · RANSOMWARE LISTING

Colombian Healthcare Firm Listed by THREEAM Ransomware Group

Coosalud, a Colombian healthcare and pharma organization with between 51 and 100 employees, was recorded on the THREEAM ransomware group's public tracker on September 28, 2026. The listing has not been accompanied by a public disclosure from the company itself. Intel128 has logged this entry and is monitoring for further developments.

Key takeaways

• Coosalud appears on the THREEAM ransomware tracker as of September 28, 2026
• The company has not publicly disclosed any incident as of this recording
• Healthcare and pharma remain a high-value target for ransomware operators
• A tracker listing is strong signal but not a confirmed breach

What was recorded

The Intel128 tracker captured a new entry on the THREEAM group's leak site. The entry references coosalud.com and categorizes the organization under Healthcare / Pharma in Colombia. The company size is recorded as 51 to 100 employees. No data samples or additional details were published alongside the listing at the time of recording.

Listing is not a confirmed breach

A ransomware tracker listing means an attacker group has published the organization's name, typically as leverage to pressure payment. It does not confirm that data was exfiltrated, that systems were encrypted, or that the attack succeeded. In some cases, groups list organizations that refused to pay or that were never actually compromised. However, the listing is a strong signal that the organization was targeted and that the attackers believe they hold something of value.

Organizations should treat a tracker listing as a trigger for internal verification rather than as proof of compromise.

Sector context

Healthcare and pharma remain among the most targeted sectors for ransomware operations. The combination of sensitive patient data, operational dependency on connected systems, and regulatory exposure makes these organizations attractive targets. A company in the 51 to 100 employee range may have limited dedicated security staff, which can extend detection and response timelines.

Disclosure status

As of the recording date, coosalud.com has not issued a public statement acknowledging an incident. This is not unusual. Many organizations delay disclosure while they investigate, notify regulators, or assess legal exposure. In some jurisdictions, healthcare entities face mandatory breach notification timelines, so a public statement may follow in the coming days or weeks.

What to watch

• Whether coosalud.com or its parent entity issues a public statement
• Whether THREEAM publishes data samples or a countdown timer
• Whether Colombian or regional regulators reference the incident
• Whether the listing is removed, which can indicate a payment or a dispute

Recommended actions for peers

Organizations in the same sector and region should treat this listing as a prompt to review their own exposure. Specifically:

• Confirm that offline backups are current and tested
• Review third-party access paths that could be leveraged for initial access
• Verify that incident response plans account for ransomware-specific scenarios, including communication with regulators and affected individuals
• Monitor for related activity on known ransomware trackers over the next 30 days

Intel128 will update this entry if new information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.