A third party claims on an internet forum to hold information on Nueva EPS members. The insurer says it has found no evidence of unauthorized access and alerted the authorities. What we know and what to do.
In early October 2026, Nueva EPS, the Colombian health insurer (EPS) with the most members in the country, said it had learned of a post on an internet forum in which a third party claims to hold information on its members. The insurer is investigating this alleged leak and, so far, has not confirmed it.
What we know so far
According to its statements, Nueva EPS activated its incident response protocol, set up a team of technology, cybersecurity and data protection specialists, and "the checks carried out have not identified evidence of unauthorized access to our systems." In a second statement it added that it activated a contingency plan, that the findings do not affect healthcare services or its administrative processes, and that it alerted the data protection authorities, which are already investigating.
Figures about the size and content of the alleged database have circulated in the media. Those figures come from the forum post, not from the insurer or an authority, so we do not repeat them until there is official confirmation.
Why it matters even if it is not confirmed
When an alleged database circulates, criminals use it for very convincing scams: calls, text messages and emails that mention your name, your ID number or your treatment to ask for payments, verification codes or for you to "update your details."
How to protect yourself as a member
- Be wary of calls or messages claiming to come from your EPS that ask for money, passwords or codes. Contact them yourself through the official channels.
- Do not open links or files from unexpected messages, even if they include your correct details.
- Turn on two-step verification for your email, WhatsApp and online banking.
If your company handles personal data
Colombia's Law 1581 of 2012 requires data controllers to protect information and to notify the Superintendency of Industry and Commerce when security codes are breached and there are risks to the data subjects' information. The practical step is to have the following ready before an incident:
- An inventory of where the databases are and who can access them.
- Encrypted backups and a response protocol with clear owners and timeframes.
- Access logs that show what happened and since when.
October 31 update: official sources only
We checked this article against Nueva EPS's statements. We removed the figures from the forum post, which only the media and the post itself had spread, and added the insurer's second statement. If an authority publishes conclusions, we will update this article.
How we help you
At Pronetsys we review the security of your servers and devices with our infrastructure management service, and we protect your databases with encrypted cloud backups. You can also see how we handle data in our personal data policy.
Sources
Source: El Colombiano
