Chattanooga Heart Institute targeted by Karakurt ransomware group

• Ransomware group: Karakurt
• Country: United States
• Sector: Healthcare
• Announcement date: May 23, 2023

Karakurt claims to have stolen data from Chattanooga Heart Institute

The threat actor known as Karakurt has listed the Chattanooga Heart Institute on its leak site, claiming to possess the institution's data. This announcement, which appeared on May 23, 2023, marks a significant potential breach for the healthcare provider. The group has claimed that they have successfully obtained a substantial amount of information belonging to the organization.

In this type of cyberattack, known as a data breach announcement, threat actors often use leak sites to pressure organizations into paying ransoms. This is a common tactic in modern ransomware operations, where the goal is not just to encrypt systems, but to steal sensitive information to use as leverage in double extortion schemes. In such scenarios, the attackers threaten to publish the stolen data publicly if their demands are not met, causing significant reputational and legal damage to the victim.

Details of the claimed attack

The threat actor known as Karakurt has created a leak announcement claiming to have obtained data belonging to the Chattanooga Heart Institute. According to the group's claims, the data stolen includes private information belonging to both employees and patients. The group states that a total of 158 GB of data is set to be published on their platform.

While the specific details regarding the ransom demand were not provided in the announcement, the scale of the data involved—158 GB—suggests a significant volume of information has been targeted. The attack was claimed to have occurred on May 23, 2023, the same day the announcement was made on the leak site.

Claimed sensitive information

The announcement claims that the stolen data contains a wide variety of highly sensitive information. The types of data the group claims to possess include:

• Medical records
• Test results
• Diagnoses
• Social security numbers
• Passport details
• Addresses
• Phone numbers
• Financial data

About the Chattanooga Heart Institute

The Chattanooga Heart Institute is a healthcare provider based in Tennessee that offers comprehensive, multidisciplinary cardiac care services. Operating under the Memorial Health System, it provides specialized medical services focused on heart health.

Impact and industry implications

This incident may lead to the exposure of sensitive patient and employee information. Because the institution is based in the United States, legal processes and regulatory penalties under the Health Insurance Portability and Accountability Act (HIPAA) may be triggered. Such regulations are designed to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.

The exposure of this specific dataset could create secondary risks for the affected individuals, such as identity theft or targeted phishing attacks. When personal identifiers like social security numbers, passport details, and financial data are compromised, attackers can use them to impersonate victims or conduct highly convincing fraudulent activities.

Regarding the threat actor, information regarding the Karakurt group is limited. In the broader cybersecurity landscape, organizations in the healthcare sector are frequently targeted due to the high value of medical records on the dark web. To defend against such threats, organizations typically need to review their data security protocols and notify the affected parties. Common defensive measures include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration.