Hyderabad-based CR Healthcare Services has allegedly suffered a ransomware attack in which hackers encrypted sensitive patient and clinical data and demanded around Rs 8.5 crore in cryptocurrency, according to a report by Telangana Today. Cyberabad Cybercrime police have begun investigating after the company lodged a complaint.
The suspected attack is believed to have occurred on September 29 and affected the company’s digital systems and patient records hosted through its healthcare platform. The attackers reportedly gained access to a large volume of information before encrypting it, potentially disrupting access to records used by the healthcare technology firm.
The data allegedly includes patients’ names, photographs, phone numbers, dates of birth, addresses, diagnostic reports, FHIR clinical records and audit reports. FHIR, or Fast Healthcare Interoperability Resources, is a digital standard used to represent and exchange healthcare information. The reported exposure therefore involves both personal identifiers and medical information.
The attackers have reportedly demanded a ransom of about Rs 8.5 crore in cryptocurrency in exchange for restoring access to the encrypted data. In a separate communication, they allegedly demanded $100,000 in cryptocurrency within 72 hours and threatened to publish the stolen information online if the payment was not made.
According to the report, the hackers shared sample patient records with the company to substantiate their claim that they had accessed its systems. The sharing of sample records is consistent with the pressure tactics commonly associated with data-extortion incidents, although the full extent of the alleged breach has not been established in the information available.
The incident highlights the exposure created when healthcare services depend on interconnected digital platforms. A successful attack on such systems can affect more than internal office operations: it can restrict access to patient records, expose medical information and create uncertainty about the integrity of clinical and administrative data. The report does not specify whether healthcare services or patients experienced operational disruptions.
The case also involves two distinct risks. Encrypting data can prevent an organisation from accessing its own records, while the alleged threat to publish stolen information creates a separate privacy and compliance concern. The available report does not establish how much data was exfiltrated, whether backups were affected, or whether any ransom was paid.
Cyberabad Cybercrime police have initiated an investigation following the company’s complaint. The investigation is expected to examine how the attackers entered the systems, which records were accessed or encrypted, and whether the ransom communications can be linked to a wider cybercrime operation. No further official details on the investigation were available in the supplied report.
The next confirmed step is the Cyberabad Cybercrime police investigation into the alleged ransomware attack and the reported compromise of CR Healthcare Services’ digital systems and patient records.