Metro Hospital USA
Attack Intelligence
Metro Hospital USA was compromised in a ransomware attack attributed to bqtlock in April 2026. The organization, operating in an undisclosed sector in Unknown, was added to the group's data leak site as part of an extortion campaign.
bqtlock operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.
Primary Domain: metro.hospital (Internet Site - before it went down) Internal/Email Domain: metro-hospital.net (internal facing nomenclature / business email) Compromised Data Volume: 5.355 TB of sensitive medical files Patient Records: 123,458 patients (scripts, radiology, eKG, MRI, ultrasound, blood work) Additional Assets: Complete email archives, SonicWall VPN access credentials, network infrastructure information, internal backups Payment Status: UNPAID 400 xmr - Private negotiation / Ransom demand active info : Metro Hospital USA suffered a full-scale compromise. Over 5.3TB of mission-critical medical data exfiltrated, including radiology images, electronic health records (EHR), diagnostic results, and personal identifiable health information. Additionally, SonicWall appliance access and complete corporate email repositories were obtained. Decryption key and deletion of stolen data available upon ransom fulfillment. Deadline strict.