Royal Bahrain Hospital: Payload Ransomware claims the hack of Royal Bahrain Hospital

Payload Ransomware Claims Breach of Royal Bahrain Hospital

On March 15, 2026, the Payload Ransomware group announced it had compromised Royal Bahrain Hospital (RBH), a prominent 70-bed healthcare facility in Bahrain. The attackers claim to have exfiltrated 110 GB of sensitive data, which they displayed on their Tor-based leak site as proof of the breach. The group has set a March 23 deadline, threatening to release the stolen data if the ransom is not paid.

RBH, established in 2011, provides inpatient and outpatient services including surgery, maternity care, and diagnostics to patients across Bahrain and neighboring Gulf nations such as Oman, Qatar, Saudi Arabia, and the UAE.

Payload Ransomware, a relatively new operation, employs a double-extortion model, encrypting files while also stealing data to pressure victims. The group primarily targets mid- to large-sized organizations in sectors like real estate and logistics, often in emerging markets. Its ransomware uses ChaCha20 encryption and Curve25519 key exchange, while disabling security tools and deleting shadow copies to hinder recovery. Like many modern ransomware crews, Payload likely operates as a ransomware-as-a-service (RaaS) scheme, leveraging a Tor leak site to expose non-compliant victims.

Source: https://securityaffairs.com/189467/cyber-crime/payload-ransomware-claims-the-hack-of-royal-bahrain-hospital.html

Royal Bahrain Hospital cybersecurity rating report: https://www.rankiteo.com/company/royal-bahrain-hospital

"id": "ROY1773591858",
"linkid": "royal-bahrain-hospital",
"type": "Ransomware",
"date": "3/2026",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'industry': 'Healthcare',
                        'location': 'Bahrain',
                        'name': 'Royal Bahrain Hospital (RBH)',
                        'size': '70-bed',
                        'type': 'Healthcare Facility'}],
 'data_breach': {'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Likely',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Sensitive healthcare data'},
 'date_detected': '2026-03-15',
 'date_publicly_disclosed': '2026-03-15',
 'description': 'On March 15, 2026, the Payload Ransomware group announced it '
                'had compromised Royal Bahrain Hospital (RBH), a prominent '
                '70-bed healthcare facility in Bahrain. The attackers claim to '
                'have exfiltrated 110 GB of sensitive data, which they '
                'displayed on their Tor-based leak site as proof of the '
                'breach. The group has set a March 23 deadline, threatening to '
                'release the stolen data if the ransom is not paid.',
 'impact': {'data_compromised': '110 GB', 'identity_theft_risk': 'High'},
 'motivation': 'Financial gain',
 'ransomware': {'data_encryption': 'Yes (ChaCha20 encryption, Curve25519 key '
                                   'exchange)',
                'data_exfiltration': 'Yes',
                'ransomware_strain': 'Payload Ransomware'},
 'references': [{'date_accessed': '2026-03-15',
                 'source': 'Payload Ransomware Tor leak site'}],
 'threat_actor': 'Payload Ransomware',
 'title': 'Payload Ransomware Claims Breach of Royal Bahrain Hospital',
 'type': 'Ransomware'}