Carespring listed on NoEscape ransomware leak site

• Ransomware group: NoEscape
• Country: United States
• Sector: Healthcare
• Announcement date: November 14, 2023

NoEscape claims attack on Carespring

The NoEscape ransomware group has listed the United States-based healthcare organization Carespring on its leak site. According to the claims made by the threat actors, the group has successfully encrypted the networks belonging to Carespring and has copied a significant amount of data from their systems. The attack is claimed to have occurred on November 10, 2023, with the subsequent announcement appearing on the group's leak site on November 14, 2023.

The NoEscape group has issued a warning regarding the stolen information. They have stated that if negotiations with the management of Carespring do not commence, the stolen data will be published publicly. The group claims to have exfiltrated approximately 364 GB of data. Information regarding the specific identity and background of this threat actor group remains limited in the public domain.

This incident follows the pattern of double extortion, a common tactic used by modern ransomware groups. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak private data, the attackers aim to pressure the victim into paying a ransom to prevent public exposure, which can lead to significant legal and reputational damage.

Alleged data types and contents

The announcement made by the NoEscape group claims that the stolen data contains a wide variety of sensitive information. The stolen files are said to include personal data belonging to both employees and patients, which represents a significant privacy concern. The breadth of the alleged theft suggests a deep intrusion into the organization's digital environment.

The specific types of data claimed to be involved in the breach include:

• Patient personal data
• Employee personal data
• Medical records
• Financial data
• Contracts

Furthermore, the group claims to have obtained medical records, examination results, and appointment records. The stolen files reportedly include patient photos, as well as various files harvested directly from the personal computers of employees. Additionally, the leaked data is said to contain financial documents, banking information, tax records, invoices, and various other files obtained during the intrusion.

About Carespring

Carespring is a healthcare organization based in Ohio, United States. The organization provides specialized rehabilitation and long-term care services. It operates various facilities that focus on clinical rehabilitation and senior care services.

Risk assessment and sector implications

The sensitivity of the data allegedly stolen in this incident poses substantial risks to the individuals involved. Both patients and employees may face heightened risks of identity theft or may become targets of highly specific, targeted phishing attacks. When personal and medical information is compromised, the ability of attackers to craft convincing social engineering campaigns increases significantly.

For organizations operating within the healthcare sector, such breaches carry heavy consequences. In the United States, the disclosure of healthcare data can lead to significant legal and administrative sanctions under HIPAA regulations. Beyond the legal implications, the organization faces secondary risks, including the potential loss of corporate reputation and the disruption of essential operational processes.

The publication of such data can also create negative impacts across the broader supply chain and pose long-term security risks for all stakeholders involved with the organization. To mitigate such risks, organizations in this sector typically focus on strengthening their defensive postures through robust encryption, strict access controls, and continuous monitoring of their networks. Implementing comprehensive employee training to recognize phishing attempts and maintaining rigorous backup protocols are also standard defensive steps used to protect against the evolving landscape of ransomware threats.