Legacy Treatment Services targeted by Interlock ransomware group

• Ransomware group: Interlock
• Country: United States
• Sector: Healthcare
• Announcement date: October 26, 2024

Interlock claims to have compromised Legacy Treatment Services

The threat actor known as Interlock has published an announcement on a leak site, claiming to have compromised data belonging to Legacy Treatment Services. This announcement, posted on October 26, 2024, marks a significant potential breach for the healthcare provider. The claim suggests that the organization has fallen victim to a targeted attack by the group.

The event unfolded when the Interlock group published their announcement on October 26, 2024, alleging they had successfully targeted the organization. According to the claims made by the threat actor, the breach involves the acquisition of various sensitive files. A screenshot provided by the group appears to support their claims, displaying a 93 GB archive file alongside a list of various backup files, indicating the scale of the alleged data theft.

Data allegedly stolen in the attack

The threat actor alleges that they have obtained a variety of sensitive information during the compromise. While the exact nature of the files is described through the group's claims, the scope of the data appears to be substantial. The stolen information is said to include internal documentation and critical databases.

The specific types of data mentioned in the claim include:

• Patient records
• Internal documents
• SQL database data

The presence of these files, particularly the large SQL database and backup files, suggests a deep intrusion into the organization's digital infrastructure. Ransomware groups often use such data in double extortion tactics, where they not only encrypt systems but also threaten to leak sensitive information on public leak sites to pressure victims into paying a ransom.

About Legacy Treatment Services

Legacy Treatment Services is a healthcare organization operating in New Jersey. The organization provides a wide range of essential medical and psychological services to its community. Their service portfolio includes mental health services, behavioral health support, addiction treatment, counseling, and medication management services.

Potential impact and industry implications

The alleged compromise of healthcare data may pose significant risks to patient privacy. Because the data involves sensitive medical and personal information, the breach could lead to identity theft or targeted phishing attacks against the affected individuals. In such scenarios, attackers often use stolen personal details to craft highly convincing fraudulent communications to further exploit victims.

For a US-based organization like Legacy Treatment Services, the alleged theft of patient records and internal documents likely means that legal processes under HIPAA regulations could be triggered. Healthcare providers are subject to strict regulatory frameworks regarding the protection of patient data, and breaches of this nature often necessitate formal investigations and notifications to regulatory bodies and affected parties.

Public information regarding the Interlock group remains limited, and their specific methods and technical capabilities have not yet been fully analyzed by the security community. This lack of visibility makes it difficult to determine the exact entry vector used in this specific instance.

In general, organizations in the healthcare sector can take several defensive steps to mitigate such risks. This includes implementing robust data security processes, maintaining regular and offline backups, and ensuring that all systems are patched against known vulnerabilities. It may also be necessary for an organization to conduct thorough reviews of its data security protocols and proactively notify all affected parties to minimize the potential harm caused by the exposure of sensitive information.