Istituto Prosperius listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: Italy
• Sector: Healthcare
• Announcement date: September 26, 2023

Rhysida claims data breach at Istituto Prosperius

The Rhysida ransomware group has listed the Italian healthcare organization Istituto Prosperius on its dedicated leak site. According to the group's announcement, the attack resulted in the exfiltration of a significant volume of data, which the threat actors claim totals 117 GB. This listing, which appeared on September 26, 2023, suggests that the attackers have successfully breached the institution's systems and are now utilizing the stolen information as leverage.

The incident is presented by the threat actors as part of an ongoing attack process that allegedly occurred on September 26, 2023. In such scenarios, ransomware groups often employ a method known as double extortion. In this tactic, attackers do not merely encrypt an organization's files to disrupt operations; they also steal sensitive information before the encryption process begins. The threat of releasing this stolen data publicly or selling it on the dark web serves as additional pressure to force the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the group has already begun releasing portions of the stolen data to the public to demonstrate the validity of their claims.

Details of the claimed data exfiltration

The Rhysida group claims to have obtained a vast collection of files belonging to the institution. The announcement specifies that approximately 116,278 files have been targeted. According to the information provided by the threat actors, the leaked content is highly sensitive and includes a variety of documents that could impact both the organization and the individuals it serves. Based on the evidence provided by the group, the affected data types include:

• Patient medical records
• Insurance policies
• Employee and doctor personal information
• Corporate documents

The presence of such diverse data types—ranging from highly personal medical histories to private corporate correspondence—highlights the potential impact of the breach. The exposure of such information can lead to severe consequences for the privacy of patients and staff members alike.

About Istituto Prosperius

Istituto Prosperius is an Italian healthcare organization that has been in operation since 1973. Founded by Prof. Mario Bigazzi, the institution specializes in the fields of rehabilitation and physical therapy. Based in Florence, the institution provides various medical services through several different health complexes, making it a significant entity within the regional healthcare landscape.

Risks and implications of the incident

The sensitivity of the allegedly exfiltrated data poses a high risk, particularly because Istituto Prosperius operates within the healthcare sector. In this industry, the protection of personal and medical information is paramount. This incident could potentially lead to significant legal sanctions and administrative fines under the European Union's General Data Protection Regulation (GDPR), which mandates strict protections for personal data. Furthermore, the exposure of patient data may result in secondary risks for the individuals involved, such as identity theft or the targeting of individuals through sophisticated phishing attacks.

For healthcare organizations, such incidents can negatively impact operational continuity and damage the institution's reputation. When a breach occurs, organizations are often required to fulfill specific data breach notification obligations, which include informing the relevant regulatory authorities and the affected parties. To defend against such threats, organizations typically focus on robust security measures, such as implementing multi-factor authentication, maintaining regular offline backups, and conducting regular employee training to recognize phishing attempts. However, the double extortion method used by groups like Rhysida remains a significant challenge for modern cybersecurity defenses.