Isapre Consalud

This record is a provider-reported ransomware claim attributed to qilin. It is an allegation and has not been independently confirmed.

Claim context

Provider-reported sector: Healthcare
Provider-reported country: Chile
Group-published claim date: 2026-11-02T00:00:00.000Z
First tracked: 2026-11-02T20:07:42.240Z
Last observed: 2026-11-02T21:02:27.671Z
Monitoring providers: 4
Independent monitoring providers: 4
Website: consalud.cl
Post URL: https://cybercrime.works/leaks/ea0ae53b-397a-4552-933a-427529e25f8d
Data source: unified
Duplicate records merged: 3

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

Monitoring provider: observed 2026-11-02T21:02:27.671Z; source-published 2026-11-02T00:00:00.000Z; retrieved 2026-11-03T00:09:40.144Z.
Monitoring provider: observed 2026-11-02T20:24:24.919Z; source-published 2026-11-02T20:24:24.919Z; retrieved 2026-11-02T20:25:14.829Z.
Monitoring provider: observed 2026-11-02T20:21:50.112Z; source-published 2026-11-02T00:00:00.000Z; retrieved 2026-11-03T10:05:19.544Z.
Monitoring provider: observed 2026-11-02T20:07:42.240Z; source-published 2026-11-02T00:00:00.000Z; retrieved 2026-11-02T20:25:14.829Z.

Provider records

Every stored provider record behind this claim, newest first.

Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:008f6f917512e4b33a4f23878d574e11f47d33e9101fedf4f53776ad698f3db4
Observed
2026-11-02T21:02:27.671Z
Source-published
2026-11-02T00:00:00.000Z
Retrieved
2026-11-03T00:09:40.144Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
RansomLook
Provider URL
https://www.ransomlook.io/
Feed id
ransomlook
Provider record id
derived-sha256:ab2afcc55d073be93b3687021fe862eda50a85afd7ace6b2be09cccc6f8c1b61
MISP event UUID
d54d1184-ac8c-5bad-bb24-07d087dad0f8
Observed
2026-11-02T20:24:24.919Z
Source-published
2026-11-02T20:24:24.919Z
Retrieved
2026-11-02T20:25:14.829Z
Format
json-array
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
ransomware.live
Provider URL
https://www.ransomware.live/
Feed id
privtools-ransomposts
Provider record id
derived-sha256:8c9ffbd3f6c9b6fba2fb656d5f615662a32ca8d885c3ec7942c264e71bc34586
Observed
2026-11-02T20:21:50.112Z
Source-published
2026-11-02T00:00:00.000Z
Retrieved
2026-11-03T10:05:19.544Z
Format
json-array
Transport
https-json
Overlap class
primary
Independent corroboration
yes
Provider credit
cybercrime.works
Provider URL
https://cybercrime.works/leaks/ea0ae53b-397a-4552-933a-427529e25f8d
Feed id
cybercrime-works
Provider record id
ea0ae53b-397a-4552-933a-427529e25f8d
Observed
2026-11-02T20:07:42.240Z
Source-published
2026-11-02T00:00:00.000Z
Retrieved
2026-11-02T20:25:14.829Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

Provider update: recorded 2026-11-02T20:55:48.741Z; associated provider observation 2026-11-02T20:07:42.240Z.
Provider update: recorded 2026-11-02T20:28:07.595Z; associated provider observation 2026-11-02T20:07:42.240Z.
Initial tracker record: recorded 2026-11-02T20:26:41.482Z; associated provider observation 2026-11-02T20:24:24.919Z.