Harry Perkins Institute of medical research listed on Medusa ransomware leak site

• Ransomware group: Medusa
• Country: Australia
• Sector: Healthcare
• Announcement date: July 7, 2024

Medusa ransomware group claims data breach at Harry Perkins Institute of medical research

The Harry Perkins Institute of medical research has been listed on the leak site of the Medusa ransomware group. According to an announcement made on July 7, 2024, the threat actor group claims to have successfully executed an attack against the institution, resulting in a significant data leak.

Details of the alleged attack

The Medusa group claims to have published data belonging to the Harry Perkins Institute of medical research on July 7, 2024. The group alleges that it has obtained access to the institution's internal building camera recordings. The total size of the alleged data is reported to be 4.6 TB. While the group has made these claims on their leak site, it is important to note that no screenshot was provided to substantiate the leak, and the specific details regarding the method of entry or the exact nature of the files remain unverified by the source.

Affected data types

• Building camera recordings

About the Harry Perkins Institute of medical research

The Harry Perkins Institute of Medical Research is a leading medical research centre based in Western Australia. The institute conducts scientific research dedicated to tackling some of the world's biggest health issues.

Security implications and industry context

This incident may pose risks to the institution's physical security and privacy policies. The leakage of camera recordings could lead to privacy violations for employees and visitors. Given the data protection obligations under Australia's Privacy Act 1988, this situation may trigger legal and administrative processes. Information about the Medusa group remains limited.

The Medusa group utilizes a tactic known as double extortion. In a double extortion scheme, threat actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption phase. The attackers then threaten to leak this stolen data on public forums or leak sites if the ransom is not paid. This approach increases the pressure on the victim, as the threat of public exposure can cause significant reputational and regulatory damage, regardless of whether the organization can restore its systems from backups.

When an organization faces a leak involving physical surveillance data, such as camera recordings, the consequences extend beyond digital security into the realm of physical safety. Such leaks can expose the movements and routines of staff and researchers, potentially compromising the integrity of sensitive laboratory environments or private workspaces. This type of breach highlights the interconnected nature of physical and cybersecurity, where a breach in the digital network can lead to direct vulnerabilities in the physical premises.

Organizations in the healthcare and medical research sectors often face heightened risks due to the sensitive nature of their work. To mitigate such risks, it is common practice for organizations to implement robust security frameworks. These typically include strict access controls to prevent unauthorized entry into sensitive networks, continuous monitoring of network traffic to detect unusual patterns, and regular security audits. Furthermore, securing Internet of Things (IoT) devices, such as internal building cameras, is a critical component of modern defense, as these devices are often targeted as entry points or sources of sensitive visual data.

Following a breach, organizations often find themselves dealing with secondary risks. Because the attackers have demonstrated they can access internal data, the institution may be exposed to secondary attacks or targeted phishing attempts. In these scenarios, attackers use the information gathered during the initial breach to craft highly convincing social engineering attacks against employees, aiming to gain further access or extract more sensitive information. Consequently, maintaining a strong security posture requires not only technical defenses but also comprehensive employee awareness programs to recognize and report suspicious activities.