Payload Ransomware Hits Royal Bahrain Hospital

A ransomware group known as Payload has claimed responsibility for a cyberattack on Royal Bahrain Hospital, announcing the theft of 110 gigabytes of sensitive patient data and threatening to release it publicly unless a ransom is paid by March 23, 2026. The hospital, a private facility in Manama, Bahrain, was added to the group's Tor-based leak site on March 15, 2026, marking it as the 12th victim in a series of breaches targeting organizations across seven countries.

The attack follows a double-extortion strategy common among modern ransomware operations, involving the exfiltration of data followed by encryption of systems to disrupt operations. Payload, which emerged as a threat actor in February 2026, has focused on mid- to large-sized companies in sectors including healthcare, real estate, energy, telecommunications, and agriculture, primarily in emerging markets. Across its claimed victims, the group alleges it has stolen a total of 2,603 gigabytes of information. In the case of Royal Bahrain Hospital, the group published images of compromised systems as proof of access, heightening pressure on the facility to negotiate.

Established in 2011, Royal Bahrain Hospital operates...