Lockbit3 claims data breach at rhp.com.br

• Ransomware group: Lockbit3
• Country: Brazil
• Sector: Professional Services
• Announcement date: September 5, 2024

The Lockbit3 ransomware group has listed rhp.com.br on its leak site, claiming to possess sensitive data belonging to the organization. This announcement, made on September 5, 2024, follows a period of alleged unauthorized access to the entity's systems.

The alleged attack and claims

According to the announcement posted by the Lockbit3 group, the alleged data breach occurred on August 28, 2024. The group claims to have successfully exfiltrated a significant volume of information, specifically stating that they hold data belonging to more than 70,000 individuals. This group of affected individuals reportedly includes patients, staff members, contractors, and investors associated with the organization.

Ransomware leak sites are frequently used by cybercriminal groups as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to release private data on a public forum, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This tactic increases the pressure on organizations, as the leak can lead to significant reputational damage and legal liabilities.

The scope of the alleged data exposure

The information claimed to be in the possession of the Lockbit3 group is extensive and covers various aspects of the organization's operations. The group alleges that the stolen data includes a wide range of sensitive documents and records. The specific types of data mentioned in the claim include:

• Patient records
• Personnel data
• Contractor information
• Investor details
• Internal corporate data

While the group has provided a screenshot of a CAPTCHA verification screen used for accessing their leak site, they have not provided any information regarding the specific size of the data stolen or the amount of ransom demanded for the non-disclosure of this information.

The organization profile

RHP (Rede Hospitalar Privada) is a healthcare network based in Brazil. The organization operates within the healthcare sector, specifically focusing on the field of hospital and clinic management.

Implications and industry context

The exposure of such a vast amount of data carries significant risks. For the employees and patients of the institution, the leak increases the risk of identity theft and fraud. Furthermore, because the institution operates in Brazil, this incident may lead to legal consequences under the LGPD (General Data Protection Law), which governs how personal data must be protected and handled within the country.

The Lockbit3 group is a Ransomware-as-a-Service (RaaS) entity that has been tracked since 2019. Although its infrastructure was disrupted by an international operation in February 2024, reports indicate that the group has since resumed its operations. The exposure of this data could potentially facilitate secondary extortion attempts or be used to launch targeted phishing attacks against the individuals involved.

For organizations operating in the healthcare and professional services sectors, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for staff to recognize phishing attempts. Additionally, maintaining strict access controls and monitoring network traffic for unusual activity can help mitigate the impact of such breaches.