Crypto24-Signed Ransomware Hits Kamalnayan Bajaj Hospital; Malaysia's Antah HealthCare Listed

A ransomware attack has disrupted billing and insurance processing at Kamalnayan Bajaj Hospital in Chhatrapati Sambhajinagar, Maharashtra, since 18 October, and the ransom note comes from a group calling itself "Crypto24 Group", the Times of India reports. On 27 October Crypto24 put Malaysian healthcare distributor Antah HealthCare Group on its leak site, claiming more than 500 GB of stolen data.

What happened at the hospital

Billing staff found at around 3am on 18 October that no bills could be generated, because the hospital management system had stopped functioning. Antivirus logs showed an attack across all nine servers. Inspector Krushnachandra Shinde, who is investigating, told the paper the hospital reported it to CERT-In before going to the police.

Satara police in Chhatrapati Sambhajinagar have registered an FIR under section 308 of the Bharatiya Nyaya Sanhita and the IT Act, on a complaint from the hospital's IT head.

The complaint doesn't give a ransom amount.

The note says files were encrypted and data stolen, and threatens publication on a Tor leak site unless the hospital gets in touch. Marathi daily Divya Marathi reports it gave three days to make contact and seven before a full leak. On 29 October the hospital wasn't among Crypto24's victims on the ransomware.live tracker.

What the hospital says about patient care

Dr Milind Vaishnav, a member of the hospital's executive committee, told the Times of India that "the services have not stopped, they have just slowed down" and that the hospital's disaster management plan was in force. The paper reports that patients' treatment benefits under government schemes have been held up since the attack.

Antah HealthCare: a claim only

Antah describes itself as "Malaysia's complete healthcare solutions network" and works as a pharmaceutical and healthcare distributor. Crypto24's post says it took employee records, customer transaction histories, commercial contracts, clinical and regulatory documents and financial statements; the post names no patient records and sets no deadline. Antah hadn't commented publicly by 29 October.

Who Crypto24 are

Trend Micro profiled the group in August 2025, describing how it blinds endpoint security with a customised version of the RealBlindingEDR tool and frequently strikes outside office hours. On 29 October ransomware.live counted 49 Crypto24 victims.