Dispossessor ransomware group lists nosm.ca on its leak site

• Ransomware group: Dispossessor
• Country: Canada
• Sector: Healthcare
• Announcement date: April 19, 2024

The Dispossessor ransomware group has listed the Northern Ontario School of Medicine University (nosm.ca) on its dedicated leak site. This announcement, made on April 19, 2024, constitutes a claim of a data breach against the Canadian institution. The group suggests that they are currently in the process of leaking or publishing data associated with the university.

The details of the claim

According to the announcement posted by the threat actor known as Dispossessor, the domain nosm.ca has been targeted in a cyberattack. The group's claim involves a data breach, though the specific timeline for the alleged intrusion is noted as June 3, 2023. While the group has officially listed the organization on its platform, the announcement primarily includes general information regarding the university's operations and its institutional mandate rather than specific technical details of the intrusion.

Ransomware groups often utilize leak sites as a method of double extortion. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish stolen data on a public platform, the threat actors attempt to pressure the victim into paying a ransom to prevent the release of confidential information. This tactic is designed to increase the pressure on an organization by threatening its reputation and legal standing.

Information regarding the alleged data breach

Regarding the specifics of the data involved in this incident, the announcement remains vague. The listing does not provide any specific details regarding the nature or the type of the alleged leaked data. Furthermore, the group has not disclosed the total size of the data or the specific file count involved in the breach. There is also no information provided regarding a ransom demand.

• No specific data types were named in the listing.

In many ransomware incidents, the lack of immediate detail in an initial leak site posting is common, as groups often use these platforms to signal their success before providing further details or negotiating with the victim. The absence of specific information regarding the files means the full scope of the potential compromise remains unquantified at this stage.

The organization profile

The Northern Ontario School of Medicine University is a public medical university located within the Canadian province of Ontario. The institution is mandated to educate doctors and contribute to the provision of healthcare in Northern Ontario's urban, rural, and remote communities.

Assessment and industry implications

The claim made by Dispossessor suggests that academic and healthcare-related data may have been compromised. Because the Northern Ontario School of Medicine University operates as a medical university in Canada, a potential data breach of this nature could trigger significant legal obligations under PIPEDA regulations. Regulatory frameworks like these are designed to ensure that organizations handle personal information with high standards of security and accountability.

Beyond the immediate regulatory concerns, secondary risks may emerge for the university's community. For staff and students, a breach involving sensitive information could lead to risks such as identity theft or the emergence of targeted phishing attacks. In these cases, stolen personal details are used to craft highly convincing fraudulent communications to deceive individuals.

Given the known activities of the Dispossessor group, it is assessed that they may utilize sensitive data as a leverage tool for extortion. For organizations operating in the healthcare and academic sectors, maintaining robust defensive postures is critical. Common defensive steps often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize social engineering attempts. As threat actors continue to target sensitive sectors, the intersection of healthcare data and academic records remains a high-value target for extortion-based ransomware groups.