Goodless Dermatology targeted by BlackSuit ransomware group

• Ransomware group: BlackSuit
• Country: United States
• Sector: Healthcare
• Announcement date: August 31, 2024

BlackSuit claims data breach at Goodless Dermatology

The BlackSuit ransomware group has published an announcement on its dedicated leak site, claiming responsibility for a cyberattack against Goodless Dermatology. According to the group's post, the organization's data has been compromised, and the threat actor has provided a download link for the allegedly stolen information.

The incident was officially announced on the group's leak site on August 31, 2024. The group claims that the breach occurred around July 16, 2024. This gap between the alleged intrusion and the public announcement is a common occurrence in ransomware operations, where attackers may spend time exfiltrating data or negotiating with the victim before making the breach public to increase pressure.

Details of the claimed data exfiltration

The BlackSuit group has made specific claims regarding the volume and nature of the data they have allegedly stolen. The group asserts that they have exfiltrated approximately 75.4 GB of data. This massive dataset is reported to consist of 36,049 individual files. The group maintains that they have successfully gained access to this information and has shared a link to facilitate the download of these files.

Based on the directory names visible in screenshots provided by the attackers, it is assessed that the stolen data may contain a variety of sensitive information. The types of data potentially included in the leak are:

• Billing records
• Administrative documents
• Patient referral information
• Biological data
• Personnel files

The presence of such diverse file types suggests a broad compromise of the organization's internal systems, ranging from administrative functions to sensitive medical and employee records.

About Goodless Dermatology

Goodless Dermatology is a healthcare provider based in Winter Park, Florida. The organization offers a range of specialized services, including medical, surgical, and cosmetic dermatology. As a healthcare entity, the organization handles sensitive patient information and operates within a highly regulated medical environment.

Potential implications and industry context

This leak may pose a significant risk of exposure for the personal health information and administrative data of patients at Goodless Dermatology. Because the organization is a US-based healthcare provider, this incident may lead to legal sanctions and compliance investigations under HIPAA regulations. The exposure of such data can create secondary risks for both patients and employees, including the potential for identity theft or targeted phishing attacks.

The group responsible, BlackSuit, is assessed to be a successor to the Royal group. Given its past operational methods, it appears that BlackSuit may be following a double-extortion strategy. In a double-extortion scenario, ransomware actors do not just encrypt an organization's data to disrupt operations; they also steal sensitive information and threaten to leak it publicly unless a ransom is paid. This tactic is designed to maximize leverage over the victim by threatening their reputation and legal standing.

For organizations in the healthcare sector, such incidents can have negative consequences for operational continuity and reputation management. To defend against such threats, organizations typically focus on robust security frameworks, including regular data backups, network segmentation, and continuous monitoring of their environments. Implementing strict access controls and conducting regular security awareness training are also vital steps in mitigating the risk of unauthorized data exfiltration and ensuring compliance with healthcare regulations.