Azienda Ospedaliera Universitaria Integrata di Verona targeted by Rhysida ransomware

• Ransomware group: Rhysida
• Country: Italy
• Sector: Healthcare
• Announcement date: November 10, 2023

Rhysida ransomware group claims data breach at Azienda Ospedaliera Universitaria Integrata di Verona

The Azienda Ospedaliera Universitaria Integrata di Verona has been listed in a data leak announcement by the Rhysida ransomware group. The group claims to have successfully gained access to the institution's network, leading to the exposure of a significant volume of sensitive information.

Details of the claimed attack and data volume

According to the announcement made on the group's leak site on November 10, 2023, the Rhysida group claims to have stolen a massive dataset. The group alleges that the stolen information consists of 612 GB of data, comprising a total of 900,128 files. The announcement specifies that the documents made public are related to the institution's healthcare services.

Rhysida is identified as a double-extortion actor that emerged in 2023. In a double-extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the stolen data on public forums or leak sites, the threat actors attempt to pressure the victim into paying a ransom to prevent the exposure of private information.

The types of data allegedly involved

Based on samples shared in screenshots provided by the group, the leaked information is highly sensitive. The data reportedly includes a variety of medical and administrative records, such as:

• Patient identification data
• Medical test results
• Treatment records
• Electronic invoice data

The inclusion of such specific medical details, including metabolic disease test results, highlights the sensitive nature of the information targeted in this incident.

Potential risks and organizational implications

The allegedly leaked data poses significant risks to patient privacy and could facilitate secondary attacks, such as identity theft, against the individuals involved. Because the Azienda Ospedaliera Universitaria Integrata di Verona is a healthcare provider operating in Italy, this incident may lead to legal sanctions and complex compliance processes under the General Data Protection Regulation (GDPR) of the European Union.

Beyond the legal and privacy implications, the nature of the institution's services means that any disruption to operational continuity could create direct risks for patient safety. Furthermore, the use of double-extortion methods by the Rhysida group can result in lasting reputational damage and the widespread exposure of private patient information. The incident may also have indirect effects on the institution's supply chain and various business partners.

Defensive considerations for healthcare institutions

While the specific response of the institution has not been disclosed, healthcare organizations generally face heightened risks from ransomware due to the critical nature of their services and the high value of medical data on the dark web. To mitigate such risks, organizations often focus on strengthening network segmentation, implementing robust access controls, and maintaining comprehensive backup strategies.

Continuous monitoring of network traffic and the implementation of multi-factor authentication are also standard defensive measures used to prevent unauthorized access. In the wake of such incidents, organizations must often engage in extensive forensic investigations to determine the full scope of the breach and work closely with regulatory bodies to manage the legal and ethical responsibilities regarding data protection and patient safety.