Minnesota’s Lake Region Healthcare Recovering From Ransomware Attack

“Activist” Group Known as DDoSecrets Leaks Mined Health Data

The “activist” group known as DDoSecrets recently posted a trove of sensitive data online, which they gathered by mining data previously leaked on dark web markets, first reported by Wired.

According to the report, the “data activists” leaked 1TB of data mined from previous dark web leaks. The data includes over 750,000 emails, photos, and other information from about five different companies.

The group offered to share another 1.9TB of data from more than 12 other companies with selected researchers or journalists. The mined data set stems from pharmaceutical, retail, finance, manufacturing, real estate, and oil industries.

DDoSecrets intends to continue leaking even more data in the coming weeks and months. For ethical reasons, HealthITSecurity.com will not share the link to the data sets, nor will it provide a platform for the group.

The screenshots of the data shared with HealthITSecurity.com show the group has leaked about 200,000 emails and other files from ExecuPharm, a pharmaceutical company used for outsourced medical trials.

As previously reported, ExecuPharm was hit with a ransomware attack in March. The hackers exfiltrated a subset of data and published it online in an attempt to extort the provider, when they refused to pay the ransom demand.

The hackers first gained access through a successful phishing campaign sent to the company’s workforce. Officials determined the hackers indeed accessed and exfiltrated corporate and personnel data, as well as personnel information from Parexel, ExecuPharm’s parent company.

The stolen data included Social Security numbers, national IDs, credit card numbers, and financial information, among other sensitive information. The pharma company was also forced to rebuild its impacted servers from backup data, as a direct result of the hack.

Coveware found that data exfiltration and subsequent extortion attempts occur in nearly half of all ransomware attacks, and it's not always caused by poor security practices.

DDoSecrets appear to be adding to the security burden and ransomware fallout already facing the healthcare sector. Notably, the Department of Homeland Security’s Office of Intelligence and Analysis designated DDoSecrets as a criminal hacking group in June, after they published 296 gigabytes of law enforcement data.

Prestera Center Email Hack

West Virginia-based Prestera Center recently began notifying a small percentage of its patients that their data was potentially compromised after a hack on its business email environment.

The notice does not detail when the security incident was first discovered, nor how the unauthorized email access occurred. Instead, officials explained that after discovering the unauthorized access to both current and former patient data, a thorough review was launched with assistance from an outside vendor.

The review determined the compromised data included names, dates of birth, medical record and or patient account numbers, diagnostic details, provider information, prescriptions, and treatments.

For some patients, contact details, SSNs, and Medicare or Medicaid numbers were exposed. The compromised data varied by patient, and all will receive free identity theft and credit monitoring services.

Prestera has since strengthened its cybersecurity infrastructure, including revising its policies and procedures, implementing multi-factor authentication for all accounts, replacing and strengthening the firewall, and enacting an intensive employee security training program.

Mattapan Community Health Center Reports Monthslong Email Hack

Mattapan Community Health Center (MCHC) in Massachusetts recently disclosed that a monthslong email hack potentially compromised the data of an undisclosed number of patients.

MCHC discovered suspicious activity in an employee email account on October 16 and immediately launched an investigation with help from a third-party computer forensic investigator.

On October 29, officials determined a hacker first gained access to the employee email account nearly three months earlier on July 28, 2020. 

The security team manually and programmatically reviewed the account to determine just what data may have been accessible to the hacker during the incident. The compromised data varied by individual but could include names, SSNs, diagnoses and treatments, provider information, health insurance details, and or medical record numbers.

MCHC has since implemented additional security measures to prevent a recurrence.