Everest ransomware group claims Primeimaging database is for sale

• Ransomware group: Everest
• Country: United States
• Sector: Technology
• Announcement date: February 1, 2024

The Everest ransomware group has announced that it is offering a significant amount of data, which it claims belongs to Primeimaging, for sale. According to the announcement posted on a leak site on February 1, 2024, the group is attempting to sell the alleged data for a ransom demand of 20,000 USD.

Details of the alleged breach

The Everest group has published a leak announcement claiming to have obtained data belonging to Primeimaging. The post states that the organization's internal data is being offered for sale for 20,000 USD. This group is known as an entity that has been active since 2020, utilizing data exfiltration and extortion tactics to pressure victims.

Ransomware groups like Everest often employ a technique known as double extortion. In this scenario, attackers do not just encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. The threat of leaking this stolen data on public or semi-public leak sites serves as additional leverage to force the victim into paying the ransom. This tactic shifts the pressure from mere operational recovery to the management of massive reputational and legal liabilities resulting from data exposure.

Alleged stolen data types

The screenshots shared in the announcement display folder structures that suggest a wide variety of sensitive information has been compromised. The listed data types include:

• Patient medical records
• Oncology results
• Employee personal data
• Passports
• Identification documents

About Primeimaging

Prime Imaging is a healthcare provider based in Tennessee, United States, specializing in medical imaging and radiology services.

Risk assessment and industry implications

The allegedly leaked data may contain highly sensitive personal health information and identification data specific to the healthcare sector. This situation could create secondary risks for the affected individuals, such as identity theft and targeted phishing attacks. When sensitive medical records and identification documents like passports are involved, the potential for misuse by malicious actors increases significantly.

Given that the organization is based in the US, legal processes and administrative sanctions under HIPAA regulations may arise. Regulatory frameworks like HIPAA are designed to ensure the privacy and security of protected health information, and breaches of this nature often trigger rigorous investigations and significant penalties. Furthermore, considering the group's past activities, it is possible that the organization could face reputational damage and operational disruptions if the data is published or sold.

For organizations operating within the healthcare sector, these types of threats highlight the necessity of robust defensive measures. Common defensive steps include implementing strict access controls to limit the reach of any single compromised account, maintaining comprehensive logging and monitoring to detect unauthorized data exfiltration, and conducting regular vulnerability assessments. Additionally, maintaining offline or immutable backups is a critical component of a modern cybersecurity posture to mitigate the impact of encryption-based attacks, though it does not directly prevent the exfiltration-based extortion seen in this case.