Knight ransomware group claims data breach at Garn Mason Orthodontics

• Ransomware group: Knight
• Country: United States
• Sector: Healthcare
• Announcement date: September 29, 2023

Knight ransomware group claims data breach at Garn Mason Orthodontics

The threat actor known as Knight has claimed to have compromised sensitive data belonging to Garn Mason Orthodontics. According to a listing on the group's leak site, the organization has been targeted in a cyberattack that allegedly resulted in the theft of significant amounts of customer information. This announcement, made on September 29, 2023, follows a pattern often seen in modern cyberattacks where threat actors use public leak sites to pressure organizations into meeting their demands.

Details of the alleged attack

The Knight group listed Garn Mason Orthodontics on its dedicated leak site on September 29, 2023. The threat actor alleges that it successfully gained access to critical data by exploiting security vulnerabilities within the organization's network. The group has stated that the stolen data will be released to the public unless the management of the organization contacts them to resolve the matter.

This method is a hallmark of double extortion tactics. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive information. The threat of releasing this data publicly serves as a powerful lever to coerce the victim into paying a ransom. While the specific technical details of the vulnerability used have not been disclosed, the group's claim suggests a breach of the network perimeter or internal security controls.

Alleged data types involved in the breach

The announcement made by the Knight group claims that the stolen dataset is highly sensitive and contains a wide variety of personal and medical information. The group asserts that the following types of data were compromised during the attack:

• Personal data
• Insurance information
• Financial and banking information
• Medical images, including images of teeth and other body parts
• Medical histories
• Doctor's prescriptions

The inclusion of such diverse data types—ranging from financial details to highly personal medical imagery—significantly increases the potential impact of the breach on the affected individuals.

About Garn Mason Orthodontics

Garn Mason Orthodontics is an orthodontic clinic located in Provo, Utah, United States. The clinic provides specialized orthodontic services to its patients, such as braces and aligner treatments.

Implications and sector risks

This incident highlights the significant risks posed to the protection of sensitive data within the healthcare sector. The nature of the allegedly leaked data, which includes medical histories and prescriptions, could increase the likelihood of patients being exposed to identity theft and targeted phishing attacks. When medical and financial information is combined, attackers can craft highly convincing fraudulent communications to exploit the victims.

Given that the organization is based in the United States, this incident may lead to legal and administrative sanctions under HIPAA regulations, which govern the privacy and security of protected health information. The release of such data could lead to severe violations of patient privacy rights and significant reputational damage to the organization.

For organizations operating in the healthcare sector, such incidents underscore the necessity of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent vulnerability assessments to identify and patch security gaps before they can be exploited by threat actors like Knight. While information regarding the specific capabilities and background of the Knight group remains limited, the threat they pose to sensitive data remains a critical concern for healthcare providers.