In early 2025, the Instituto Saúde e Cidadania (Isac) – a social organization that manages public healthcare units in Goiás, Rio Grande do Sul, Bahia, Alagoas, Piauí, and Tocantins – suffered a ransomware attack that brought systems to a halt and put approximately 500,000 patient records at risk. Among the potentially exposed data were names, dates of birth, medical records, test results, and diagnoses. Of this total, 78,772 belonged to children and adolescents; another 47,921 to elderly individuals.

The National Data Protection Authority (ANPD) initiated a sanctioning administrative proceeding against Isac, pointing out serious failures in data protection, inadequate communication to victims, and the absence of basic security controls. The case, besides illustrating the risks surrounding the processing of sensitive information, serves as an urgent warning for any organization that handles personal data – especially those operating in critical sectors such as healthcare, finance, and infrastructure.

In this article, we will dissect the incident, connect the dots with the requirements of LGPD and GDPR, and propose a practical roadmap for operations, support, and SRE teams to elevate their information security posture to a level of real resilience.

The Isac incident: what went wrong in practice

According to the ANPD's infraction notice, the attack was ransomware-type: criminals encrypted the original data and also the backups stored on cloud servers, temporarily making systems unavailable. The entity, however, could not accurately inform which data were accessed or extracted, because there was simply no robust logging mechanism – a tool that records activities in systems and allows tracking accesses and actions in case of an incident.

The ANPD listed the following weaknesses:

• Absence of logs and monitoring: without automatic records, it became impossible to determine the real extent of the compromise.
• Insufficient backup protection: the backup copies were on the same cloud accessed by the attackers, violating the principle of environment isolation.
• Inadequate communication to data subjects: instead of individually notifying affected patients, Isac limited itself to a notice on its website, without informing the date, nature of the data, or measures adopted – items required by the LGPD and by the ANPD's specific regulation on Security Incident Communication.
• Minimization of the incident: the organization claimed there was no leak, but did not present technical evidence to support that claim, even after repeated requests from the authority.

The ANPD's Superintendent of Inspection, Fabrício Guimarães, was emphatic: “Those dealing with health data must adopt the most rigorous information security model possible. On our risk scale, health data are probably one of the highest scales, perhaps in the same model we imagine for the financial sector.”

The proceeding may result in sanctions ranging from a warning to fines of up to 2% of revenue (limited to BRL 50 million), plus possible prohibition of processing personal data. More than the financial risk, there remains the reputational stain and the loss of trust from patients and public contractors.

LGPD and GDPR: the legal umbrella that caught Isac

The General Data Protection Law (Law No. 13,709/2018) establishes that health data are “sensitive personal data” and therefore require heightened protection. The processing of such information may only occur with the data subject's explicit consent or by legal obligation, and always accompanied by technical and administrative measures capable of ensuring a level of security compatible with the risk.

Among the principles violated in the Isac case, the ANPD highlighted:

• Prevention (art. 6, VIII): the controller must adopt measures to prevent the occurrence of harm. The lack of logs and the fragility of backups indicate that Isac was not adequately prepared.
• Accountability and rendering of accounts (art. 6, X): the processing agent must proactively demonstrate compliance. Isac was unable to prove the effectiveness of the measures it claimed to have adopted.
• Duty to communicate (art. 48): in the event of a security incident that may cause relevant risk or harm, the controller must notify the ANPD and the data subjects. The ANPD understood that the communication was generic and late.

For organizations with international operations, the European General Data Protection Regulation (GDPR) imposes similar requirements – and even heavier fines, which can reach 4% of global revenue. The case serves as an example: those processing data of European citizens, even without an establishment in the EU, are subject to the same rules and cross-border enforcement.

Why information security is not a cost, but continuity insurance

The attack on Isac illustrates an uncomfortable truth: backup is not synonymous with protection. Storing copies in the same cloud environment, without logical and physical isolation, nullifies the recovery strategy. Likewise, giving up logs and monitoring is like operating a data center in the dark – impossible to detect intrusions or assess damage.

For operations, support, and SRE teams, the incident reveals three pillars that need to be revisited:

1. Identity and access governance

Many ransomware attacks start with compromised credentials. It is essential to adopt multifactor authentication (MFA) for all administrative access, review permissions regularly, and apply the principle of least privilege.

2. Monitoring and observability

Centralized logs, performance metrics, and real-time alerts are not a luxury – they are the line of defense that allows identifying suspicious movements before data kidnapping consolidates. Tools like Zabbix, Prometheus, or SIEM solutions should be integrated into the daily operation.

3. Backup resilience and disaster recovery plan

Backups should follow the 3-2-1-1-0 rule: three copies of data, on two different types of media, one offsite copy, one immutable copy, and zero errors after restoration tests. Cloud storage must be isolated from the main network, with separate credentials and strong encryption.

Checklist: 10 practical actions to avoid an “Isac case” in your organization

1. Classify data: identify what is sensitive, where it is stored, and who can access it. Health, financial, or minor data require additional controls.
2. Implement MFA: require a second authentication factor for access to critical systems, VPNs, and administrative portals.
3. Enable detailed logs: record authentication events, configuration changes, and accesses to sensitive data. Store them centrally and securely.
4. Centralize monitoring: use an observability platform (e.g., Grafana, Elastic Stack, Datadog) with dashboards and alerts for anomalies.
5. Isolate backups: store copies on a different cloud or offline media, with immutable retention for a minimum period defined in RPO/RTO.
6. Test restoration periodically: a backup that cannot be restored is just an expense. Simulate full system recovery at least once per quarter.
7. Develop an incident response plan: define roles (who triggers, who communicates), notification channels (internal and external), and a template for notifying data subjects and the ANPD.
8. Maintain a vulnerability update program: prioritize critical fixes based on CVSS and keep an asset inventory.
9. Train teams: promote phishing simulations and awareness about social engineering. The human link is usually the weakest.
10. Document everything: the ANPD requires evidence. Security test reports, access review minutes, and previous incident records are proof of the preventive posture.

Conclusion: the price of omission is higher than the investment in security

The Isac case makes it clear that having a contract with a cloud provider or backup software is not enough. Data security is a continuous process that requires governance, technology, and human preparedness. The LGPD does not forgive negligence – and the ANPD has been demonstrating that it is willing to apply heavy sanctions to those who treat sensitive data with disregard.

The takeaways for your operation are clear:

• Health data (and any sensitive data) are assets of extremely high risk: processing them without robust controls is an imminent legal and financial liability.
• Monitoring and logs are not optional: without visibility, your team is flying blind and will not be able to assess an incident.
• Real resilience depends on tested and isolated backups: the false sense of protection is the main ally of criminals.

Don't wait for the ANPD to knock on your door. Start today a review of your security controls, document the measures adopted, and prepare your team to respond – and not just react – when the next attack tries to kidnap your data.