Curenta.com targeted by RansomHub ransomware group

• Ransomware group: RansomHub
• Country: Israel
• Sector: Healthcare
• Announcement date: November 21, 2024

The RansomHub ransomware group has officially claimed responsibility for a data breach involving the healthcare technology company curenta.com. According to an announcement made on a leak site, the threat actors have published data allegedly belonging to the organization, marking a significant incident for the entity.

The details of the claim

The threat actor known as RansomHub has published data that is allegedly belonging to curenta.com on their designated leak site. In their announcement, the group has stated that if the institution does not meet their specific ransom demands, all of the stolen data will be shared publicly. No information was provided regarding the specific amount of the ransom demand.

As part of this announcement, the group has publicly listed various samples of patient records that they claim were obtained from the institution's internal systems. This tactic is a hallmark of double extortion, a method where cybercriminals not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information to pressure the victim into paying a ransom. By leaking samples, the group aims to demonstrate the validity of their theft and increase the pressure on the target organization.

Data allegedly involved in the leak

The data that has been leaked, according to the group's claims, includes a wide range of sensitive information. The contents of the breach reportedly involve highly personal and protected information that could be used for malicious purposes. The specific types of data allegedly included in the leak are:

• Patient identification data
• Social security numbers
• Medical records
• Medication records
• Insurance information
• Contact information

No information was provided regarding the total size of the data stolen or the total number of files involved in the incident.

About curenta.com

Curenta is a healthcare technology company that specializes in the digitization of pharmacy services. The company focuses on optimizing medication management processes for various care facilities. Its primary role involves providing medication supply chain and logistics solutions specifically designed for long-term care facilities.

Impact and industry implications

This leak may increase the risk of identity theft and fraud for the individuals whose information was allegedly compromised. Given the extreme sensitivity of health data, this situation could lead to significant compliance issues under strict regulations such as HIPAA. The organization may face substantial challenges regarding the protection of patient privacy and maintaining trust with its clients.

Furthermore, there is a high possibility that the leaked data could be used in secondary attacks or targeted phishing campaigns against the affected individuals. RansomHub is identified as a Ransomware-as-a-Service (RaaS) structure that emerged in early 2024. It is reported that the group absorbed affiliates after the operations of ALPHV and is reported to have ceased operations in early 2025.

In the healthcare sector, such incidents highlight the critical need for robust defensive measures. Organizations in this space often prioritize end-to-end encryption, strict access controls, and continuous monitoring to protect sensitive patient information. Implementing multi-factor authentication and conducting regular security audits are standard practices used to mitigate the risks posed by evolving ransomware threats.