Analysis: Top Ransomware Gangs Targeting Healthcare Sector

guest · Oct 18, 2021

Analysis: Top Ransomware Gangs Targeting Healthcare Sector
October 18, 2021
https://www.databreachtoday.com/analysis-top-ransomware-gangs-targeting-healthcare-sector-a-17755

Ransomware attacks are continuing to threaten the U.S. and global healthcare sectors, in part due to many entities' high dependency on legacy systems and lack of security resources, says new analysis by the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center.

By analyzing ransomware activity in the U.S. and global healthcare sectors during the third quarter – from July 1 to Sept. 30 – HC3 says it identified ten major ransomware groups affecting organizations, with the Conti ransomware group being the most active in the U.S. and globally.
Click to expand...

For the most part, the top ten ransomware groups targeting U.S. healthcare organizations were similar to global findings, with a few exceptions, HC3 notes.
Top Gangs
Globally, HC3 says the top ransomware groups impacting healthcare organizations in the third quarter in order were: Conti; Avaddon; REvil/Sodinokibi; Clop; Pysa; Astro; Doppel/Paymer; Hive; LockBit; and Raganork.

"The threat landscape is constantly evolving, with affiliates often working with multiple gangs and the gangs themselves constantly rebranding - sometimes when they attract too much attention, and sometimes in an effort to skirt OFAC sanctions," says threat analyst Brett Callow of the security firm Emsisoft.
Click to expand...

guest · Dec 23, 2021

New Data Reveals Extent of Ransomware Attacks on the Healthcare Sector
December 20, 2021

The CyberPeace Institute has released new data on cyberattacks on the healthcare industry. According to the latest figures, 295 cyberattacks are known to have been conducted on the healthcare sector in the past 18 months between June 2, 2020, and December 3, 2021. The attacks have been occurring at a rate of 3.8 per week and have occurred in 35 countries.

The CyberPeace Institute said some threat actors have specifically targeted the healthcare sector. One example provided was a member of the Groove ransomware operation who was actively seeking initial access brokers who could provide access to healthcare networks. The Groove ransomware operation had the highest percentage of healthcare targets than other sectors based on its data leak site.
Click to expand...

Data from Mandiant have revealed 20% of ransomware victims are in the healthcare sector, suggesting the industry is being extensively targeted. The FIN 12 threat actor is known to target the healthcare sector, and ransomware operations such as Conti, Pysa, and Hive have high percentages of healthcare organizations in their lists of victims (4%, 9%, and 12% respectively).

While there has been some targeting of the healthcare sector, many ransomware gangs use spray and pray tactics and indiscriminately conduct attacks that result in healthcare organizations being attacked along with all other industry sectors.
Click to expand...

guest · Jan 10, 2022

HHS Warns Healthcare Sector of Pysa Ransomware Threats
Alert Comes as Health Entities Globally Continue Battling Cyberattacks, Fallout
January 10, 2022

U.S. government authorities are warning healthcare sector entities of rising threats involving Pysa ransomware and the cybercriminal gang Mespinoza - also known as Gold Burlap and Cyborg Spider - which operates the malware variant.

In an alert, the Department of Health and Human Services' Health Sector Cybersecurity Coordination Center, or HC3, warns that since 2018 the cybercrime group Mespinoza has had a history of targeting many industries, including healthcare, and continues to develop its capabilities and increase its targeting frequency.

"Pysa is used to target industries like education, utilities, transportation, construction, business services and, most notably, the healthcare and public health sector," HC3 writes.
"Although the Pysa variant has only been known to be operating since December 2019, it quickly became one of the more prolific threats against healthcare," HC3 says.
Click to expand...

"In 2020, it was one of the top ten ransomware variants used to target healthcare … beating out many other well-known variants such as Clop, LockBit, Nemty, RagnarLocker, Avaddon, MountLocker and SunCrypt."
Aggressive Group
HC3 notes that the Geneva, Switzerland-based Cyber Peace Institute, an independent nongovernmental organization, found that Pysa was one of the most aggressive among all ransomware groups in targeting healthcare over the last two years.

Also, unlike many other cybercrime groups of late, Mespinoza is not known to operate as ransomware as a service, HC3 says. The top five countries targeted by Pysa ransomware attackers are the U.S., the U.K., Canada, Spain and Brazil.
Click to expand...

colinp · Jan 11, 2022

A local hospital (in a nearby town) got nailed back in December. Not sure if they got it sorted out yet, but I know a couple ladies who work there and pretty well all their files were back to paper as their digital stuff was compromised. they had to close their emerg dept. Bad stuff for sure.

wshrugged · Jan 15, 2022

Likely ransomware:

MRIoA Discloses Data Breach Affecting 134,000 People
By Ionut Arghire on January 11, 2022

Medical Review Institute of America (MRIoA) on Friday started notifying some individuals that their personal information was compromised in a cyberattack.

The incident, MRIoA says, was discovered on November 9, 2021. A couple of days later, the organization discovered that personal information was compromised in the attack and, by November 16, it had managed to retrieve it.

The investigation into the incident has revealed the theft of protected health information such as names, gender, physical and email addresses, phone numbers, birth dates, Social Security numbers, full clinical information (including diagnosis, treatment, medical history, and lab test results), and financial information (such as health insurance policy and group plan number).[…]

Furthermore, the organization said it “retrieved and subsequently confirmed the deletion of” the stolen data, which suggests that MRIoA contacted the attackers and negotiated with them.[…]
Click to expand...

https://www.securityweek.com/mrioa-discloses-data-breach-affecting-134000-people

guest · Aug 22, 2022

Evolving Ransomware Threats on Healthcare
The Risks of Operating Legacy Technology with Limited Security Resources
August 22, 2022

With a constant need to do more with less, digital transformation is crucial to healthcare organizations' ability to deal with issues like staffing shortfalls and the increased need for services while providing better patient outcomes.

Put simply: modern medicine needs technology. It’s become an essential tool in nearly every doctor’s bag. (And, quite frankly, vital to hospitals, clinics, insurers and the entire industry.)

While healthcare as an industry is being most targeted by ransomware, health or medical clinics are by far the hardest hit.
Click to expand...

Unfortunately, that dependence on IT, and the value of stolen healthcare data, makes healthcare organizations a prime target for cyberattacks, particularly ransomware. From 2020 to 2021, during the height of the COVID-19 pandemic, ransomware attacks on healthcare providers nearly doubled with a majority of healthcare providers having been hit.

More recently, analysis and reports from the U.S. Department of Health and Human Services' Health Sector Cybersecurity Coordination Center (HC3) have shown that the ransomware threat is not abating — and worse, is evolving.

“Ransomware remains a major threat to the health sector worldwide, with many healthcare organizations operating legacy technology with limited security resources,” the HC3 said in late 2021.
Click to expand...

Ransomware Threats Targeting Healthcare Continue to Evolve
In 2022, threat actors evolved the tactics, techniques, and procedures (TTPs) used in their healthcare ransomware attacks.

One prolific gang targeting healthcare, FIN12, typically takes less than two days to execute its file-encrypting payload.
Click to expand...

guest · Aug 24, 2022

Hospitals in US, France Dealing With Cyber Extortionists
Texas Hospital Still Being Pressured, While French Hospital Responds to Ransomware
August 23, 2022

A Texas-based hospital is apparently still contending with pressure to pay an extortion group that claims to have stolen patient data months ago, while a Paris-area medical center reportedly responds to a weekend attack and demands to pay a $10 million ransom.

While the details of the incidents differ, together they spotlight the ongoing ransom threats that healthcare sector entities globally are facing and the need for to stay proactive in their defenses and response plans.

"Organizations should be prepared to spend some time enriching their business continuity and disaster recovery programs," says Will Clark, a virtual CISO and principal consultant at privacy and security consultancy Clearwater.
"After all, being prepared for exactly this type of event is likely the best response."
Click to expand...

Methodist McKinney/Karakurt Saga
McKinney, Texas-based Methodist McKinney Hospital in an statement issued on July 29 and updated on Aug. 3 about its incident says that it became aware on July 5 "of unusual activity on certain systems."

Methodist McKinney says its investigation confirmed that an unauthorized actor accessed certain systems and "copied" certain files containing patient information between May 20 and July 7 (see: Vendor Ransomware Breach Affected 942,000 Patients)
Click to expand...

However, in a "press release" posted last Friday on the darkweb, extortion group Karakurt - which takes credit for the attack - blasts Methodist McKinney for refusing to negotiate.
A few days earlier, Karakurt had threatened on its dark web site to publish more than 367 GB of data stolen from the healthcare provider.

In its attempt to pressure Methodist McKinney Hospital, Karakurt alleges that the entity "found out about the data breaches much earlier" than the hospital suggests in its public statement, and that on July 5 it entered into a dialogue with the group, "thereby confirming the fact of data leak."

"During this dialogue, within two weeks, we provided McKinney Hospital with all the confirmations and the file listing - this means that by July 21, - when the hospital interrupted the dialogue - it was already clear to Methodist McKinney Hospital what exact data we have," Karakurt alleges. "They had enough time to notify their patient about the massive data breach before this announcement."
Click to expand...

'Pinky Promises'
Karakurt is an "exfiltration-only" group that does not encrypt data, which been active since the middle of last year, says Brett Callow, a threat analyst at security firm Emsisoft. Karakurt may have some personnel overlap with the now defunct Conti operation, he adds.

"According to Karakurt, Methodist McKinney did not pay the demand - and that was absolutely the right decision," Callow says.
Click to expand...

CHSF Hospital Centre Attack
The 1,000-bed CHSF Hospital Centre in Corbeil-Essonnes, which is located southeast of Paris, has been dealing with a ransomware attack that began late Saturday night, according to local news site RFI.

The attack is disrupting the hospital's IT, medical imaging and other systems, with hackers demanding a multi-million-dollar ransom, RFI reports.
Click to expand...

guest · Sep 3, 2022

mood said: ↑

Hospitals in US, France Dealing With Cyber Extortionists
Texas Hospital Still Being Pressured, While French Hospital Responds to Ransomware
August 23, 2022
Click to expand...

Methodist McKinney says its investigation confirmed that an unauthorized actor accessed certain systems and "copied" certain files containing patient information between May 20 and July 7 (see: Vendor Ransomware Breach Affected 942,000 Patients)
Click to expand...

Ransomware attack on billing vendor leads to data theft for 942K patients
By Jessica Davis - August 23, 2022

Practice Resources recently notified 942,138 patients that their data was accessed or stolen ahead of a ransomware attack deployed in April. The New York-based vendor provides billing and professional services to a range of healthcare entities.

The ransomware attack was launched against Practice Resources on April 12, prompting the vendor to secure the systems and investigate the incident. They found personally identifiable information and health data was likely subjected to access and/or acquisition. The exposed data included names, contact details, dates of treatment, and health plan or medical record numbers.
Click to expand...

Approximately 28 healthcare providers were affected by the security incident. It’s among at least three other vendor breaches reported within the last month alone to include dozens of impacted providers, including the ransomware attack on vendor OneTouchPoint that included data from more than 326,000 Aetna ACE patients.
Click to expand...

guest · Sep 1, 2022

OneTouchPoint Ransomware Victim Count Increases to 2.65 Million
September 1, 2022

The number of individuals affected by the ransomware attack on the Hartland, WI-based mailing and printing vendor, OneTouchPoint, has now increased to 2,651,396 individuals, with Common Ground Healthcare Cooperative one of the latest organizations to confirm that it has been affected. Brookfield, WI-based Common Ground Healthcare Cooperative said 133,714 of its members were affected.

OneTouchPoint said it discovered the attack on April 28, 2022, when files on its systems were encrypted. A forensic investigation was launched to determine the nature and scope of the security breach, which revealed its servers were compromised on April 27, 2022, and certain files containing sensitive data were accessed. The review of those files confirmed on July 15, 2022, that they contained the sensitive information of current and former employees and data of its customers. Customers were notified about the attack on June 3, 2022.
Click to expand...

Initially, the breach was reported as affecting 1.1 million individuals, but the total has now been increased to 2,651,396 individuals. At least 34 organizations are known to have been affected, including Matrix Medical Network breach also affected Blue Shield of California Promise Health plan Kaiser Permanente, Geisinger, Health First, UPMC Health Plan, Humana, Aetna ACE, Anthem Inc, and other Blue Cross Blue Shield affiliates.
Click to expand...

guest · Nov 11, 2022

US Health Dept warns of Venus ransomware targeting healthcare orgs
By Sergiu Gatlan @serghei - November 10, 2022

The U.S. Department of Health and Human Services (HHS) warned today that Venus ransomware attacks are also targeting the country's healthcare organizations.
Click to expand...

In an analyst note issued by the Health Sector Cybersecurity Coordination Center (HC3), HHS' security team also mentions that it knows about at least one incident where Venus ransomware was deployed on the networks of a U.S. healthcare org.

However, there is no known data leak site that threat actors deploying Venus ransomware are known to use for publishing stolen data online, according to HC3's report.

"HC3 is aware of at least one healthcare entity in the United States falling victim to Venus ransomware recently," the report warns.
"The operators of Venus ransomware are not believed to operate as a ransomware-as-a-service (RaaS) model and no associated data leak site (DLS) exists at this time."
Click to expand...

Ransomware targeting healthcare
U.S. federal authorities have warned about other ransomware operations targeting healthcare organizations across the United States this year.

Previous alerts include warnings of threat actors deploying Maui and Zeppelin ransomware payloads in attacks against Healthcare and Public Health (HPH) organizations.
Click to expand...

guest · Nov 25, 2022

Lorenz Ransomware Alert: Risk to Healthcare, Public Sector
Group Hitting Large Victims, Health Sector Cybersecurity Coordination Center Warns
By Mathew J. Schwartz @euroinfosec - November 24, 2022

Large healthcare and public sector organizations are continuing to get hit by attackers wielding Lorenz ransomware, cybersecurity experts warn.

"It is used to target larger organizations in what is called 'big-game hunting,' and publishes data publicly as part of pressuring victims in the extortion process," according to a new security alert from the U.S. Department of Health and Human Services.
"Relatively little is known about Lorenz as compared to many other ransomware operators," says HHS' Health Sector Cybersecurity Coordination Center, or HC3.
Click to expand...

Known victims of Lorenz include Wolfe Eye Clinic in Iowa, which fell victim in April 2021, and refused to pay a ransom. Protected health information for up to 500,000 patients was exposed.
Among other recent victims, Lorenz on Nov. 14 claimed via its data leak site to have breached Salud Family Health of Colorado, reports threat intelligence firm Kela.

Security experts say Lorenz appears to be wielded by a single group, as well as to be a human-operated ransomware operation.
Click to expand...

Data Leaking, With a Twist
Like many ransomware groups, Lorenz often exfiltrates data from victims, threatening to dump it onto its Tor-based site if they don't pay a ransom.

But Lorenz tends to take a "non-typical" approach if victims don't pay, HC3 says. "They will next release password-protected RAR archives containing the victim data. Finally, if they fail to monetize the data - if the victim does not pay and the data does not sell, they will release the password for the full archives, so they will be publicly available for anyone to access."
Click to expand...

HHS HC3: Analyst Note - Lorenz Ransomware
(PDF): https://www.hhs.gov/sites/default/files/lorenz-analyst-note.pdf

HC3: Analyst Note
November 21, 2022 TLP:CLEAR Report: 202211211700
Lorenz Ransomware
Executive Summary
Lorenz is human-operated ransomware that has been in operation for approximately two years. In that time, HC3 is aware of the compromise of healthcare and public sector targets. It is used to target larger organizations in what is called “big-game hunting”, and publishes data publicly as part of pressuring victims in the extortion process. Lorenz is known to target organizations globally using customized code, and can demand hundreds of thousands of dollars in ransoms.
Click to expand...

guest · Dec 8, 2022

US Health Dept warns of Royal Ransomware targeting healthcare
By Sergiu Gatlan @serghei - December 8, 2022

The U.S. Department of Health and Human Services (HHS) issued a new warning today for the country's healthcare organizations regarding ongoing attacks from a relatively new operation, the Royal ransomware gang.

The Health Sector Cybersecurity Coordination Center (HC3) —HHS' security team— revealed in a new analyst note published Wednesday that the ransomware group has been behind multiple attacks against U.S. healthcare orgs.

"Since its appearance, HC3 is aware of attacks against the Healthcare and Public Healthcare (HPH) sector," the advisory says.
"Due to the historical nature of ransomware victimizing the healthcare community, Royal should be considered a threat to the HPH sector."
Click to expand...

This ransomware group is focused on targeting U.S. healthcare organizations based on past successful attacks.
Until now, Royal also claimed following each healthcare compromise that they leaked all data allegedly stolen from the victims' networks online.
Sharp increase in activity since September
The Royal Ransomware gang is a private operation without affiliates and made up of experienced threat actors who worked for other groups.
Click to expand...

HC3: Analyst Note - Royal Ransomware
(PDF): https://www.hhs.gov/sites/default/files/royal-ransomware-analyst-note.pdf

HC3: Analyst Note
December 07, 2022 TLP:CLEAR Report: 202212071400
Royal Ransomware
Executive Summary
Royal is a human-operated ransomware that was first observed in 2022 and has increased in appearance. It has demanded ransoms up to millions of dollars. Since its appearance, HC3 is aware of attacks against the Healthcare and Public Healthcare (HPH) sector. Due to the historical nature of ransomware victimizing the healthcare community, Royal should be considered a threat to the HPH sector.
Click to expand...

guest · Dec 29, 2022

Ransomware attack at Louisiana hospital impacts 270,000 patients
By Bill Toulas @billtoulas - December 28, 2022

The Lake Charles Memorial Health System (LCMHS) is sending out notices of a data breach affecting almost 270,000 people who have received care at one of its medical centers.

LCMHS is the largest medical complex in Lake Charles, Louisiana, comprising a 314-bed hospital, a 54-bed women's hospital, a 42-bed behavioral health hospital, and a primary care clinic for uninsured citizens.
Click to expand...

According to the announcement posted on the LCMHS site, the cybersecurity incident occurred on October 21, 2022, when the organization's security team detected unusual activity on the computer network.

An internal investigation concluded on October 25, 2022 revealed that hackers had gained unauthorized access to LCMHS' network and then stole sensitive files.
LCMHS reported the incident to the secretary of the U.S. Department of Health and Human Services (HHS). The portal for healthcare-related breaches now reports that 269,752 individuals have been impacted by the incident.
Click to expand...

Hive ransomware claims the attack
The Hive ransomware group listed LCMHS on its data leak site on November 15, 2022, a step that typically comes after failed negotiations for paying a ransom.
Hive has also published the files allegedly stolen after breaching LCMHS systems.

The listed files include bills of materials, cards, contracts, medical info, papers, medical records, scans, residents, and more. BleepingComputer could not confirm if these files are authentic or not.
Click to expand...

guest · Jan 6, 2023

HPH Sector Warned About Clop Ransomware-as-a-Service Operation
January 6, 2023

The Health Sector Cybersecurity Coordination Center (HC3) has shared information on the Clop (Cl0p) ransomware-as-a-service operation, the affiliates of which are known to conduct attacks on the healthcare and public health (HPH) sector.

Clop ransomware was first detected in February 2019 and is the successor to CryptoMix ransomware. The group is highly active and was apparently unaffected by the arrest of six operators of the ransomware in 2021, with activity continuing despite the arrests. The group was active throughout 2022, with one month seeing the group conduct attacks on 21 organizations.
Click to expand...

The group uses double extortion tactics, where sensitive data are stolen prior to file encryption and a ransom payment is necessary to prevent the publication of the stolen data and to obtain the keys to decrypt files. Some attacks linked to the group have only involved data theft and extortion. The group follows through on its threats to publish stolen data when the ransom is not paid, as was the case with the attack on the pharmaceutical giant ExecuPharm, where emails, financial records, documents, and database backups were posted on the group’s leak site.
Click to expand...

The Clop ransomware gang is highly capable, well-funded, and prolific, and is considered to pose a significant threat to the HPH sector.
Click to expand...

HC3: Analyst Note - Clop Ransomware
(PDF): https://www.hhs.gov/sites/default/files/clop-ransomware-analyst-note-tlpclear.pdf

HC3: Analyst Note
January 04, 2023 TLP:CLEAR Report: 202301041300
Clop Ransomware
Executive Summary
Clop operates under the Ransomware-as-service (RaaS) model, and it was first observed in 2019. Clop
was a highly used ransomware in the market and typically targeted organizations with a revenue of $5
million U.S. Dollars (USD) or higher. Since its appearance, HC3 is aware of attacks on the Health and
Public Health (HPH) sector. The HPH sector has been recognized as being a highly targeted industry for the
Clop ransomware.
Click to expand...

guest · Jan 7, 2023

Hive Ransomware gang leaked 550 GB stolen from Consulate Health Care
By Pierluigi Paganini - January 7, 2023

Consulate Health Care is a leading provider of senior healthcare services, specializing in post-acute care. The Hive ransomware gang this week added the company to its Tor leak site, threatening to publish the stolen data.
Click to expand...

The gang states that the attack took place on December 3rd, 2022 and the attack was disclosed on January 6, 2023.

The gang initially leaked samples of the stolen data as proof of the attack, it claimed to have stolen contracts, NDA and other agreements documents, company private info (budgets, plans, evaluations, revenue cycle, investors relations, company structure, etc.), employees info (social security numbers, emails, addresses, phone numbers, photos, insurances info, payments, etc.), and customers info (medical records, credit cards, emails, social security numbers, phone numbers, insurances, etc.).
Click to expand...

According to DataBreaches, the company had ended negotiations after several weeks because they could not afford even the reduced amount demanded because their insurance would not cover any ransom payment.

While the CHC’s notice highlights that that the root cause of the data breach is an attack against a vendor, Hive representatives told Data Breaches that they “did not attack any CHC vendor but had attacked CHC directly.”
Click to expand...

guest · Jan 7, 2023

Saint Gheorghe Recovery Hospital in Romania suffered a ransomware attack
By Pierluigi Paganini - January 6, 2023

The Saint Gheorghe Recovery Hospital in Botoşani, in northeastern Romania, was hit by a ransomware attack in December that is still impacting medical operations.
Click to expand...

The hospital is not able to report the services performed in December 2022 and for this reason, it cannot receive payment for the medical services provided.

The threat actors demanded a ransom of 3 Bitcoin to decrypt the data on the infected systems. It seems that the attackers abused a remote connection used for maintenance purposed by a third-part service provider.

“The attack is similar to the one in the summer of 2019, when four other hospitals in Romania were targeted. The hackers apparently got through by using a remote connection accessed by one of the maintenance companies.” reported the website Romania Insider.
“The hackers entered the system and encrypted the December database. After that, they left a message, in English, asking for a ransom of 3 Bitcoin, or approximately EUR 46,400.”
Click to expand...

According to the media outlet, the attack was sophisticated, and both the Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT) and the Romanian antivirus firm BitDefender were not able to decrypt the files.

In 2019 other four hospitals in Romania suffered ransomware attacks that were attributed to the PHOBOS extortion group.
Click to expand...

guest · Jan 11, 2023

Hackers stole data of 460,000 individuals in MFHS ransomware attack
By Carly Page @carlypage_ - January 11, 2023

Pennsylvania-based nonprofit health provider Maternal & Family Health Services has confirmed cybercriminals accessed the sensitive data of close to half a million people.
Click to expand...

MFHS revealed last week that it had been hit by ransomware that exposed the personal data of current and former patients, employees and vendors. The healthcare giant said it was made aware of the incident on April 4, 2022 but admitted that may have been initially compromised as far back as August 21, 2021.

When asked by TechCrunch at the time, MFHS declined to confirm how many individuals were affected. However, a notification from the Maine attorney general’s office this week reported that a total of 461,070 people, including 68 Maine residents, are affected by the breach.
Click to expand...

It remains unclear who was behind the ransomware attack, if MFHS paid a ransom demand, and why the non-profit didn’t disclose the incident sooner. MFHS didn’t immediately respond to TechCrunch’s questions on Wednesday, and it doesn’t appear that any major ransomware group has yet claimed responsibility for the incident.
Click to expand...

guest · Jan 17, 2023

Attacks on 2 Specialty Care Providers Affect Nearly 600,000
Both Ransomware Incidents Occurred in 2022
By Marianne Kolbasuk McGee @healthinfosec - January 16, 2023

Two specialty medical care firms - a Texas-based home healthcare agency and a Pennsylvania-based women's and family health clinic - are reporting separate ransomware breaches that in total affect nearly 600,000 individuals.
Click to expand...

Dallas-based Home Care Providers of Texas reported its incident to the Texas attorney general's office on Jan. 13 as affecting about 124,000 residents of the Lone Star State. The company's breach notification statement indicates that an undisclosed number of North Carolina residents are also affected.

Meanwhile, Wilkes-Barre, Pennsylvania-based nonprofit Maternal and Family Health Services reported a ransomware incident on Jan. 10 to the Maine attorney general's office as affecting nearly 461,200 individuals, including 68 Maine residents. MFHS supports a network of health and nutrition centers in 17 Pennsylvania counties.
Click to expand...

The incidents follow a growing trend of ransomware criminals hitting a widening range of different types of healthcare providers and their vendors, including smaller and specialty entities.

"Healthcare data is very lucrative right now and the criminals know that small to medium-sized companies tend to have less security than larger companies," says Jerry Caponera, general manager of cyber risk at security firm ThreatConnect.
Click to expand...

guest · Jan 18, 2023

BlackCat, Royal Among Most Worrisome Threats to Healthcare
By Marianne Kolbasuk McGee @healthinfosec - January 17, 2023

Healthcare entities should be on high alert for signs of the BlackCat and Royal ransomware-as-a-service groups, warns the U.S. government, which characterizes the groups as "relatively new but highly capable" threats.
Click to expand...

The Department of Health and Human Services' Health Sector Cybersecurity Coordination Center in a Thursday threat brief warns that BlackCat conducts triple extortion, meaning it doesn't just maliciously encrypt data and demand an extortion payment, but also threatens to leak the data and conduct distributed denial-of-service attacks against victims if they don't pay up. Royal hews to the now more traditional double-extortion method of demanding a ransomware payment backed with the threat of a data breach.
Click to expand...

Each group has roots in earlier ransomware groups. BlackCat, also known as Alphv, is suspected of being a successor group to Darkside and BlackMatter, with ties to some former REvil members, and Royal is known to have former operators from cybercriminal group Conti Team One.

Royal doesn't have BlackCat's stated compunctions about targeting healthcare providers. "Royal is a particularly nasty strain of ransomware and features a significant number of evasion techniques," Galinkin says.
Click to expand...

Royal & BlackCat Ransomware: The Threat to the Health Sector
(PDF): https://www.hhs.gov/sites/default/files/royal-blackcat-ransomware-tlpclear.pdf

TLP:CLEAR, ID# 202301121300
Royal and BlackCat Ransomware
The U.S. health sector continues to be aggressively targeted by ransomware operators, and Royal and BlackCat are two of the more recent sophisticated ransomware threats.
Click to expand...

guest · Jan 21, 2023

Electronic health record giant NextGen dealing with cyberattack
By Jonathan Greig @jgreigj - January 20, 2023

Hospital technology giant NextGen Healthcare said it is responding to a cyberattack after a notorious ransomware group added the company to its list of victims.
Click to expand...

The multibillion-dollar healthcare giant produces electronic health record (EHR) software and practice management systems for hundreds of the biggest hospitals and clinics in the U.S., U.K., India and Canada.

On Tuesday, hackers associated with the AlphV/BlackCat ransomware added the company to its list of victims alongside several other businesses.
Click to expand...

A spokesperson for NextGen Healthcare said it is aware of the claim and explained that they have been working with cybersecurity experts to “investigate and remediate” the issue.

“We immediately contained the threat, secured our network, and have returned to normal operations,” the spokesperson said. “Our forensic review is ongoing and, to date, we have not uncovered any evidence of access to or exfiltration of client data. The privacy and security of our client information is of the utmost importance to us.”
Click to expand...

AlphV/BlackCat continues to be one of the most commonly seen ransomware strains, accounting for more than 100 attacks since it emerged in 2021.
Click to expand...

guest · Jan 22, 2023

Impact of ransomware on healthcare: what’s confirmed and what’s just speculative?
January 22, 2023

What impact do ransomware attacks have on delivering healthcare services to patients? Some claims have been made, but are the claims supported by any objective data, or are people just guessing what the impact has been or could be?

In this week’s news, a hospital in Illinois announced it will be temporarily closing due to a combination of factors and events. 25News reports:
So how do we assess the impact of the ransomware attack in this type of case? It is undoubtedly challenging.
Click to expand...

Then, too, consider a report by Ponemon, who surveyed 579 cybersecurity professionals. A key part of their findings is presented below:
According to their report, more than 1 in 3 respondents said ransomware resulted in increased complications from medical procedures, and more than 1 in 5 respondents responded that ransomware attacks adversely impacted patient mortality rates (respondents could identify more than one type of impact).

But on what do the respondents base their reports?
But if you are going to claim that a ransomware attack led to increased mortality, then what happened as a result of the attack that was responsible?
Click to expand...

And now here we are, again reading claims about the impact of crimes on healthcare. And again, DataBreaches is asking how these claims are being substantiated.

Do ransomware attacks have an impact on patient care? There’s certainly the potential for harmful impact in many situations, but we shouldn’t be guessing or assuming.
Click to expand...

guest · Jan 24, 2023

2 Vendors Among BlackCat's Alleged Recent Ransomware Victims
By Marianne Kolbasuk McGee @healthinfosec - January 23, 2023

An electronic health records vendor and a pharmacy management services firm are purportedly among the latest healthcare sector victims of ransomware-as-a-service group BlackCat, also known as Alphv.
Click to expand...

Irvine, California-based NextGen Healthcare, which offers cloud-based EHRs, and Blanco, Texas-based PharmaCare Services, a provider of pharmacy management and consulting services, appeared on BlackCat's leak site late last week.

The site still lists PharmaCare as a victim but took down its NextGen listing for unknown reasons. The reclusive author behind DataBreaches.net wrote that BlackCat had removed its listing shortly after she confronted a spokesperson of the ransomware-as-a-service group with a statement from NextGen that it has not seen evidence of a data breach.
Click to expand...

Prior Warning
The alleged BlackCat incidents come on the heels of a recent U.S. Department of Health and Human Services warning to the healthcare sector about threats involving the cybercrime group (see: BlackCat, Royal Among Most Worrisome Threats to Healthcare).
Click to expand...

guest · Feb 8, 2023

Drug distributor AmerisourceBergen confirms security breach
By Bill Toulas @billtoulas - February 8, 2023

Pharmaceutical distributor AmerisourceBergen confirmed that hackers compromised the IT system of one of its subsidiaries after threat actors began leaking allegedly stolen data.
Click to expand...

AmerisourceBergen is a pharmaceutical product distributor, medical business consultant, and patient services provider. The company is a giant in the healthcare industry, employing 42,000 people and operating multiple distribution centers in the United States, Canada, and the UK, with 150 offices worldwide.

As first reported by security researcher Dominic Alvieri, the Lorenz ransomware gang ended a lengthy period of silence by listing AmerisourceBergen and their allegedly stolen data on its extortion site.
Click to expand...

AmerisourceBergen confirmed the attack to BleepingComputer, stating that the intrusion was contained and they are investigating whether the incident has resulted in the compromise of sensitive data.

The Lorenz ransomware group has posted all files allegedly stolen from AmerisourceBergen and MWI Animal Health, presumably the subsidiary that was breached.
The threat actors set the post date to November 1, 2022, even though the files were published just now, which might indicate that the breach happened a couple of months back.
Click to expand...

It is important to note that while the leaked files appear genuine, AmerisourceBergen has not yet confirmed these files were stolen from its networks.
Click to expand...

guest · Feb 10, 2023

California medical group data breach impacts 3.3 million patients
By Bill Toulas @billtoulas - February 10, 2023

Multiple medical groups in the Heritage Provider Network in California have suffered a ransomware attack, exposing sensitive patient information to cybercriminals.

The medical groups impacted by the cyberattack are Regal Medical Group, Lakeside Medical Organization, ADOC Medical Group, and Greater Covina Medical.
Today, the healthcare organization reported on the U.S. Department of Health and Human Services breach portal that the data of 3,300,638 patients was exposed in the attack.
Click to expand...

Sensitive data were stolen in attack
The data breach notification says the ransomware attack occurred on December 1, 2022, with Regal's employees noticing technical difficulties the following day.

After engaging a third-party cybersecurity expert to help investigate, it was determined that malware had infected the organization's servers, so a system restoration process was initiated.
Regal's notice encloses instructions on enrolling for one year of free credit monitoring via Norton LifeLock.

"Regal understands the importance of safeguarding your personal information and takes that responsibility very seriously," reads the notice.
Click to expand...

The healthcare organization says they have implemented additional security measures and stricter protocols to prevent similar incidents and safeguard sensitive patient information from unauthorized access.

Impacted patients should look out for targeted phishing attacks, scams, social engineering, or extortion using stolen data.
Click to expand...

Log in or Sign up

Analysis: Top Ransomware Gangs Targeting Healthcare Sector

guest Guest

guest Guest

guest Guest

colinp Registered Member

wshrugged Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Analysis: Top Ransomware Gangs Targeting Healthcare Sector

guest Guest

guest Guest

guest Guest

colinp Registered Member

wshrugged Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches