Brooklyn Premier Orthopedics data leaked by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: United States
• Sector: Healthcare
• Announcement date: September 5, 2023

ALPHV claims to have leaked data from Brooklyn Premier Orthopedics

The ALPHV ransomware group has announced a significant data breach involving Brooklyn Premier Orthopedics. According to a post made on the group's leak site on September 5, 2023, the threat actor group claims to have released a dataset totaling 126 GB of information allegedly belonging to the healthcare provider. This announcement follows a period of alleged negotiations between the ransomware group and the medical institution.

The group asserts that the decision to publish the data was a direct result of unsuccessful negotiations with the organization. In such scenarios, ransomware groups often employ a tactic known as double extortion. This method involves not only encrypting an organization's internal systems to disrupt operations but also exfiltrating sensitive data prior to the encryption phase. The threat actors then threaten to leak the stolen information on public forums or dedicated leak sites if the ransom demands are not met, thereby increasing the pressure on the victim organization.

Details of the alleged data leak

The information released by the ALPHV group is claimed to be highly sensitive, consisting of a large volume of data. While the specific file count was not provided in the announcement, the group claims the total size of the dataset is 126 GB. The leak was officially announced through a post dated September 5, 2023, which coincides with the date the group claims the attack occurred.

Based on screenshots provided by the threat actors, the leaked content appears to include a variety of highly personal and sensitive documentation. The exposed information reportedly includes:

• Patient medical records
• Social security numbers
• Passports
• Various identification documents

The presence of such diverse and sensitive documentation highlights the high-stakes nature of attacks against healthcare providers, where the data stolen is often irreplaceable and highly valuable on the dark web.

About Brooklyn Premier Orthopedics

Brooklyn Premier Orthopedics is a healthcare center that specializes in the fields of orthopedics and pain management. The institution serves a broad patient base within the New York and New Jersey metropolitan areas. The facility provides a comprehensive range of orthopedic services, spanning from conservative management approaches to complex surgical procedures designed to treat various conditions.

Impact and security implications

The exposure of this specific dataset carries significant risks for the individuals whose information has been compromised. The combination of medical records and government-issued identification, such as passports and social security numbers, significantly increases the risk of identity theft and fraud for the affected patients. Such data allows malicious actors to impersonate individuals in various legal, financial, and medical contexts.

For the organization, this breach may lead to substantial legal consequences. In the United States, the healthcare sector is governed by strict data protection regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), which mandates the protection of sensitive patient health information. Failure to secure this data can result in regulatory scrutiny and legal liabilities. Furthermore, the sensitivity of the leaked information may cause long-term security risks for the patients and lead to significant reputational damage for Brooklyn Premier Orthopedics.

The ALPHV group is known in the cyber threat intelligence community for utilizing Rust-based malware and employing the aforementioned double-extortion tactics. Although reports indicate that the group's activities were said to have ceased as of March 2024, the data leaked in previous incidents remains a persistent threat. Such datasets can be utilized by different threat actors for secondary attacks or sold on illicit marketplaces, meaning the risk to the victims remains even after the initial threat actor has moved on.

To mitigate such risks, organizations in the healthcare sector typically focus on robust defensive measures. These include implementing strict access controls, maintaining regular backups, and ensuring continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, encryption of data at rest and in transit is a fundamental step in protecting sensitive patient information from being useful to attackers even if a breach occurs.