Everest ransomware group lists Total Patient Care LLC;A Sensitive Touch Home Health;Alphastar Home Health Care;Heart of T on its leak site

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: December 17, 2024

The Everest ransomware group has issued an announcement on its dedicated leak site claiming to have stolen and leaked data belonging to several healthcare organizations. The threat actor specifically named Total Patient Care LLC, A Sensitive Touch Home Health, Alphastar Home Health Care, and Heart of Texas Home Healthcare Services Inc. as targets of their operation. This announcement, posted on December 17, 2024, suggests a targeted campaign against these specific entities within the United States healthcare sector.

The details of the claim

According to the announcement published by the Everest group, the threat actors have made data associated with the listed healthcare organizations accessible to the public. The group claims to have utilized an external file-sharing platform, specifically identified as gofile.io, to host the allegedly stolen information. The listing was officially created on December 17, 2024, which aligns with the date the group claims the attack occurred.

Ransomware groups often utilize leak sites to exert pressure on their victims. This tactic is a central component of double extortion, a method where attackers not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data before the encryption occurs. By threatening to release this data on a public or semi-public platform, the attackers aim to increase the likelihood of receiving a ransom payment through the threat of reputational damage and regulatory scrutiny.

Information regarding the leaked data

While the Everest group has identified the specific organizations they claim to have targeted, the announcement lacks granular details regarding the specific nature or content of the allegedly leaked data. There is no information available regarding the volume of files or the specific types of records that may have been compromised. The listing names no specific data types.

In many such cyberattacks, the stolen information can range from administrative records to highly sensitive personal information. When data is moved to an external file-sharing service, it becomes accessible to a wider audience, significantly increasing the risk of unauthorized exposure. However, in this specific instance, the group has not provided a breakdown of the files or the categories of information contained within the alleged leak.

Implications for the healthcare sector

The claim made by the Everest group carries significant implications for the involved healthcare entities. For organizations operating within the United States, such as the ones named in the announcement, the potential exposure of sensitive information may trigger complex data privacy violation processes under the Health Insurance Portability and Accountability Act (HIPAA) regulations. These regulations mandate strict protections for patient health information and require specific protocols when a breach is suspected or confirmed.

The publication of sensitive information can lead to severe consequences for both the organizations and the individuals involved. For the healthcare providers, it can result in a loss of trust from patients and significant legal or regulatory challenges. For the individuals whose data may have been exposed, the risks include breaches of privacy and secondary threats such as identity theft. The sensitive nature of healthcare data makes it a high-value target for threat actors who employ data exfiltration and extortion methods.

To mitigate these risks, organizations in the healthcare sector typically focus on robust defensive strategies. These include implementing strong access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and conducting regular security assessments. Furthermore, when a breach occurs, organizations are often required to fulfill data breach notification obligations, which include informing the affected parties and relevant regulatory authorities to ensure transparency and compliance with legal standards.