“New low” – hackers publish photos of breast cancer patients

A well-known IT security expert speaks of a new low. And it refers to the working methods of the notorious ransomware gang ALPHV.

The unknown perpetrators, who are believed to be from Russia (or a Russian-speaking country), have recently published documents on the dark web that allegedly come from American breast cancer patients.

Apparently, the criminal organization, also known as BlackCat, is trying to blackmail a medical facility in Pennsylvania. To reinforce their threat, the perpetrators published the first sensitive documents on the Darknet leak site. It is said to include clinical recordings stolen from the Lehigh Valley Health Network in the northeastern United States.

hospital association affected

An association of 13 hospitals and other healthcare facilities in Pennsylvania is affected. The patient photos would have been taken in connection with radiation therapy to fight malignant cancer cells.

Watson verified a similar report from the American online medium The Record on Tuesday morning. The leak location of the ALPHV gang was temporarily limited. This may indicate a large number of concurrent access attempts.

Addressed to their victim, the blackmailers write:

Shocked reactions

IT security expert Max Smeets of ETH Zurich responded with an angry tweet on Monday after the criminals published the first files containing the threat on their leak site on March 4.

Malware analyst Ryan Chapman tweeted:

ALPHV is one of the most active and dangerous groups offering ransomware as a service (RaaS). The criminals had also recently hit the Swiss financial institution Finaport en masse and disclosed larger amounts of stolen data via the Darknet.

The gang’s specialty is double and triple extortion, referred to in technical jargon as “Double Extortion” and “Triple Extortion” respectively. This means that in addition to encrypting files in the foreign network, the criminals also threaten to publish the previously secretly copied data on a so-called leak site. As if that weren’t enough, they try to pressure their unwilling victims with server overload (DDoS) attacks.

In mid-February, the criminals leaked six gigabytes of data they allegedly stole from Ireland’s Munster Technological University. They contain confidential information, including staff medical diagnoses and student bank account information.

Sources