Artistic Family Dental targeted by Everest ransomware group

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: November 13, 2024

Everest ransomware group claims data breach at Artistic Family Dental

The Everest ransomware group has officially listed Artistic Family Dental on its dedicated leak site, claiming to have successfully compromised the institution. According to the threat actor, the breach involves a significant amount of sensitive information belonging to approximately 5,000 patients. This announcement, made on November 13, 2024, follows the group's typical pattern of using public leak sites to pressure victims into meeting specific demands.

In many modern ransomware attacks, threat actors utilize a method known as double extortion. In this scenario, the attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption occurs. By threatening to publish this stolen information on a public leak site, the group increases the pressure on the victim organization, as the exposure of private data can lead to severe regulatory penalties and loss of public trust.

Details of the claimed attack

The Everest group has announced that the data belonging to Artistic Family Dental is slated for publication. Through their communication, the threat actors have stated that representatives from the dental clinic must contact them before a specified deadline expires to avoid the release of the information. The group asserts that the stolen dataset contains both medical and personal information pertaining to 5,000 patients.

The group has provided evidence to support their claims through screenshots. These images reportedly show various sensitive documents, including electronic remittance advice documents from insurance providers Humana and UnitedHealthcare. Furthermore, the leaked materials are said to include patient X-rays and specific details regarding personal treatment information.

Affected data types

Based on the claims made by the Everest group, the following types of information have been identified as potentially compromised:

• Patient medical records
• Personal data
• Insurance payment information
• Radiological images

The inclusion of such diverse data types highlights the sensitivity of the information targeted in healthcare-related cyberattacks. When medical records and insurance details are taken together, they provide a comprehensive profile of an individual's health history and financial identifiers.

About Artistic Family Dental

Artistic Family Dental is a dental clinic located in Las Vegas, Nevada. The facility provides a variety of oral health services to its community, including general dentistry, cosmetic dentistry, and preventive oral health services.

Risk assessment and industry implications

This claim poses a significant risk to the protection of sensitive data within the healthcare sector. The documents shared by the threat actor suggest that health information protected under HIPAA regulations may have been exposed. Such exposure can lead to secondary risks for the affected individuals, including the potential for identity theft and various forms of fraud.

Given the established history and past activities of the Everest group, there remains a high possibility that the data could be leaked to the public or sold on illicit marketplaces. When such breaches occur, organizations often face complex legal and regulatory landscapes. Depending on the jurisdiction and the nature of the data, the institution may be required to fulfill specific data breach notification obligations and proactively inform all affected individuals about the compromise of their information.

To defend against such threats, organizations in the healthcare sector typically implement defensive measures such as multi-factor authentication, robust encryption for data at rest and in transit, and continuous monitoring of network traffic to detect unauthorized exfiltration. Furthermore, maintaining strict access controls ensures that sensitive patient information is only accessible to authorized personnel, reducing the potential impact of a single compromised credential.