Everest ransomware group claims MCNA Dental data breach

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: September 16, 2024

Everest ransomware group claims MCNA Dental data breach

The Everest ransomware group has announced an alleged data breach involving MCNA Dental, claiming to have obtained a massive volume of sensitive information. According to the announcement posted on a leak site on September 16, 2024, the threat actors claim to have accessed over 1 million patient records belonging to the organization. This claim follows a pattern of double extortion tactics often seen in modern ransomware operations, where attackers not only encrypt systems but also threaten to publish stolen data to pressure victims into paying a ransom.

Details of the alleged attack

The threat actor responsible for the claim, identified as the Everest group, stated that the breach occurred on September 16, 2024. In their announcement, the group issued an ultimatum to the organization, stating that if MCNA Dental does not contact them within a 24-hour window, all the stolen data will be published publicly. To demonstrate the validity of their claims, the group provided samples of internal company documents and various patient records.

This type of threat is a hallmark of contemporary cyber extortion. In such scenarios, the attacker leverages the sensitive nature of the stolen information to maximize pressure on the victim. By threatening to release data on a public leak site, the group aims to cause maximum reputational and regulatory damage to the target organization. The use of samples is a common psychological tactic used by ransomware groups to prove they have successfully exfiltrated data from the target's internal network.

Data involved in the breach

The announcement claims that the stolen dataset is extensive, potentially containing over 1 million personal Electronic Medical Records (EMR) alongside various internal company documents. Based on the samples provided by the Everest group, the information appears to include highly sensitive personal and medical details. The specific types of data mentioned as being affected include:

• Patient health records
• Personal contact information
• Insurance information

The samples released by the attackers reportedly include specific identifiers such as patient names, physical addresses, dates of birth, phone numbers, and insurance-related information. The presence of such granular data increases the risk of secondary exploitation, such as identity theft or highly targeted phishing campaigns directed at the individuals whose information was compromised.

Organization profile

MCNA Dental is an organization that provides dental benefit management services for government-sponsored healthcare programs in the United States. The company offers dental insurance and network management services under programs such as Medicaid and CHIP.

Impact and assessment

This alleged breach may pose a significant risk for an organization operating in the healthcare sector. Given that the entity is based in the United States, potential data privacy violations and legal sanctions under HIPAA regulations could arise. The sensitive nature of Electronic Medical Records (EMR) makes healthcare organizations particularly attractive targets for ransomware groups due to the high value of the data and the critical necessity for uptime in medical services.

Considering the past activities of the Everest group, it is assessed that the group actively employs data exfiltration and extortion tactics. The stolen data may be utilized for identity theft or targeted phishing campaigns. For organizations in the healthcare sector, such incidents highlight the necessity of robust security measures to protect patient confidentiality and maintain compliance with strict regulatory frameworks. The organization and the affected individuals may need to remain vigilant against secondary attacks and implement necessary security measures to mitigate the impact of the leaked information.