Dispossessor ransomware group lists tgh.org on its leak site

• Ransomware group: Dispossessor
• Country: United States
• Sector: Healthcare
• Announcement date: April 19, 2024

The threat actor known as Dispossessor has published data allegedly belonging to tgh.org on their leak site. The announcement, made on April 19, 2024, claims that the group has successfully targeted the organization and has access to its internal information.

The details of the claim

The Dispossessor group has listed tgh.org on its leak site, claiming to have published data belonging to the organization. According to the group's announcement, the data is accessible, suggesting that the group is targeting the operational information of the institution. This type of activity is common in modern ransomware campaigns, where threat actors use leak sites to pressure victims through the threat of public exposure.

The group's claim suggests that the breach may have occurred as early as July 5, 2023, though no specific details regarding the method of entry were provided. In many ransomware scenarios, attackers utilize a double extortion tactic, where they not only encrypt an organization's systems but also exfiltrate sensitive data to use as leverage during negotiations. By hosting the data on a public-facing leak site, the group aims to increase the visibility of the incident and the pressure on the victim.

Data involved in the leak

The announcement contains personal and corporate contact data, specifically targeting the leadership of the institution. The leaked information includes the names, titles, phone numbers, and email addresses of various executives within the organization. This information is highly sensitive as it provides a roadmap for further targeted attacks.

The specific types of data mentioned in the listing include:

• Employee contact information
• Executive personal data

The inclusion of executive-level details is a significant escalation in a cyberattack, as it moves the threat from general corporate data to specific, high-value targets within the organizational hierarchy.

About Tampa General Hospital

Tampa General Hospital (TGH) is a leading academic medical center and non-profit health system located in Tampa, Florida. Providing comprehensive medical services, the hospital also maintains an educational and research partnership with the University of South Florida Health Morsani College of Medicine.

Risk assessment and industry implications

The leak may increase the risk of targeted spear-phishing or social engineering attacks against the organization's employees and executives. When attackers possess specific names, titles, and direct contact information, they can craft highly convincing messages that appear to come from trusted colleagues or authorities, making it much easier to bypass traditional security perimeters.

Given that the entity operates in the healthcare sector, the leaked data may be subject to regulations such as HIPAA, and the organization could face potential legal sanctions. Healthcare organizations are high-value targets for cybercriminals due to the critical nature of their operations and the sensitivity of the data they manage. Secondary risks may include the use of leaked contact information for identity theft or attempts to infiltrate corporate networks.

The Dispossessor group is a structure that emerged in late 2023 and is known for its actions against law enforcement; this may increase the severity and motivation of the attack. For organizations in the healthcare sector, maintaining robust defensive postures is essential. This includes implementing multi-factor authentication, conducting regular security awareness training to defend against social engineering, and ensuring strict adherence to regulatory compliance standards to mitigate the impact of potential data exposure.