Inc Ransom ransomware group lists falp.org on its leak site

• Ransomware group: Inc Ransom
• Country: Switzerland
• Sector: Healthcare
• Announcement date: December 27, 2024

Inc Ransom claims data breach at falp.org

The threat actor known as Inc Ransom has listed the Fundación Arturo López Pérez (falp.org) on its dedicated leak site. According to the announcement published by the group, the organization has been targeted in a cyberattack resulting in a data breach. This claim was made on December 27, 2024, following an alleged intrusion that occurred on December 22, 2024.

Details of the alleged attack

The announcement from Inc Ransom asserts that the group successfully gained unauthorized access to the systems belonging to falp.org. By breaching the network, the threat actors claim to have exfiltrated data from the organization's infrastructure. This type of activity is characteristic of modern ransomware operations that focus on data theft to increase their leverage over a victim.

Inc Ransom has been active in the cyber threat landscape since mid-2023. The group is known for employing a double-extortion strategy. In a double-extortion scheme, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information. This allows them to threaten the victim with the public release of the stolen data if a ransom is not paid, thereby creating dual pressure on the target.

Data involved in the incident

Regarding the specific content of the breach, the announcement provided no specific details regarding the nature of the alleged stolen data or file samples. The listing does not name any specific data types or provide information on the volume of information compromised.

About Fundación Arturo López Pérez

Fundación Arturo López Pérez (FALP) is a private healthcare institution based in Santiago, Chile. The organization specializes in the diagnosis and treatment of cancer. As a non-profit foundation, FALP provides comprehensive medical services specifically within the field of oncology.

Impact and assessment of the threat

The potential implications of this alleged breach are significant due to the nature of the organization's operations. Given that the organization operates in the healthcare sector, there may be a possibility that the alleged stolen data includes sensitive patient information. Such a scenario could lead to legal repercussions for the organization under relevant health data protection regulations.

The publication of such data may create secondary risks for affected individuals, including identity theft and targeted phishing attacks. Furthermore, considering the group's double-extortion method, it is assessed that the organization's operational continuity and reputation could be negatively impacted.

In general, organizations in the healthcare sector face heightened risks due to the high value of medical records on the dark web. To mitigate such risks, many organizations implement defensive measures such as multi-factor authentication, regular security audits, and robust data encryption. However, when a breach occurs, the focus often shifts to incident response and managing the legal and reputational fallout resulting from the exposure of sensitive information.