Unverified claim — May 2026: A threat actor branding as KurdFemboys / FEMBOYSec Intelligence Team advertised a database allegedly stolen from Vietnam’s Ministry of Health, citing more than 480,000 doctor, nurse, and medical-staff records. Dark Web Informer reported a first batch offered as a free download plus an extortion threat to sell remaining data.
To be clear: this is an actor listing. Public confirmation from the Ministry of Health was not available in trade-press sources reviewed at indexing time.
What the listing claims
Alleged fields include national ID and demographics, document numbers, residential addresses, phone and email, workplace affiliation, and medical practice-certificate codes and dates—exactly the kind of roster that enables targeted phishing of licensed clinicians.
Who should care
Vietnamese doctors, nurses, and other licensed practitioners should treat unexpected “MoH credential renewal” or “practice certificate” messages as hostile until verified through official ministry channels.
Action items
- Do not open attachments or click links in unsolicited MoH-themed email.
- Monitor for identity fraud using national ID and practice-certificate numbers.
- Ministry IT should treat free-download samples as potential authentic exfil until proven otherwise and rotate exposed credentials.
Canonical record: Vietnam MoH FEMBOYSec claim 2026.