Ransomware Group: NIGHTSPIRE

VICTIM NAME: Al Tadawi Specialty Hospital

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the NIGHTSPIRE Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The victim of this ransomware incident is Al Tadawi Specialty Hospital, located in the United Arab Emirates. The attack was publicly disclosed on June 9, 2025, shortly after the compromise occurred on June 8, 2025. The breach involved the exfiltration of approximately 1.5 terabytes of data, indicating a significant data theft operation. The incident has been linked to the threat group known as Nightspire, which is known to conduct targeted attacks against healthcare organizations. The leak page suggests that sensitive internal data may have been accessed or compromised, although no specific PII or patient information is detailed publicly.

The page includes limited visual content, with no screenshots or explicit images provided publicly. It indicates that the attackers potentially aimed to threaten or pressure the victim by releasing the stolen data. The primary information available emphasizes the size of the data breach and the timeline of the attack, highlighting the serious nature of the incident within the healthcare sector in the region. There are no visible links to download the leaked data, but the presence of a leak suggests potential exposure of confidential operational data or proprietary information from the hospital’s systems.