Lockbit3 claims data breach at call4health.com

• Ransomware group: Lockbit3
• Country: United States
• Sector: Healthcare
• Announcement date: April 19, 2024

Lockbit3 claims data exfiltration against call4health.com

The Lockbit3 ransomware group has officially listed the healthcare provider call4health.com on its dedicated leak site. According to the announcement made on April 19, 2024, the threat actor group claims to have successfully compromised the organization's data and is now threatening to publish the stolen information online.

This incident follows a pattern of double-extortion tactics frequently employed by modern ransomware groups. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also focus on stealing sensitive information. The threat of leaking this data serves as a powerful lever to exert pressure on the victim organization to meet ransom demands. While the group has published samples of documents related to the organization's operational processes, specific details regarding the total volume of data stolen or the exact ransom amount demanded have not been provided in the announcement.

Details of the claimed data theft

The information released by the Lockbit3 group includes various screenshots intended to prove the validity of their claims. These samples suggest that the breach involves a wide range of sensitive documents and personal identifiers. The leaked content appears to target both organizational operations and individual privacy.

The data types identified in the group's announcement include:

• Employee HR data
• Personally identifiable information
• Social security numbers
• Driver's license information
• Financial records

The presence of such highly sensitive information, including social security numbers and financial records, significantly elevates the risk profile of the incident. When such data is exposed, it often leads to secondary threats such as identity theft and various forms of fraud targeting the individuals whose information was compromised.

About call4health.com

Call 4 Health is a specialized company operating within the healthcare sector. The organization provides customized medical answering services and a variety of patient communication solutions designed specifically for healthcare organizations. With over 20 years of experience in the industry, the company offers professional telephone answering services tailored for hospitals and clinics to manage their communications effectively.

Implications and industry context

The potential publication of this data carries significant risks for the organization, including potential reputational damage and serious legal consequences. Because call4health.com operates within the healthcare sector, the compromised data may fall under strict regulatory frameworks, such as the Health Insurance Portability and Accountability Act (HIPAA), which governs the protection of sensitive patient health information.

Lockbit3 is a Ransomware-as-a-Service (RaaS) group that has been active since 2019. The group reportedly resumed its operations following an international disruption that occurred in February 2024. The resilience of such groups highlights the ongoing challenge faced by critical infrastructure and service providers.

For organizations operating in the healthcare and communication sectors, such incidents underscore the necessity of robust defensive postures. Common defensive steps for organizations include implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring comprehensive data encryption for both resting and transit data. Furthermore, regular security awareness training and comprehensive incident response planning are essential to mitigate the impact of such sophisticated extortion attempts.