Lockbit3 ransomware group lists clinicatezza.com.pe on its leak site

• Ransomware group: Lockbit3
• Country: Peru
• Sector: Healthcare
• Announcement date: August 11, 2024

LockBit3 claims attack on Clinica Tezza

The LockBit3 ransomware group has officially listed clinicatezza.com.pe on its dedicated leak site. This announcement, made on August 11, 2024, serves as an indication that the institution's data may have been compromised. The group claims to have conducted malicious activities against the organization's systems, with the claimed attack date occurring on May 16, 2024.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information on public forums if a ransom is not met. This tactic is designed to maximize pressure on the victim by threatening reputational damage and legal consequences through the exposure of private information.

Details regarding the claimed data breach

Regarding the specifics of the incident, the nature of the leaked or threatened data has not been disclosed by the threat actors. The information provided by the group consists of a generic verification page from their leak site, which does not offer specifics on the content of the breach. Consequently, the listing names no specific data types.

At this stage, the volume of files involved and the specific amount of data exfiltrated remain unknown. There has been no information provided regarding a ransom demand or the specific files that the group intends to release. The lack of detail in the initial listing is a common occurrence in the early stages of a ransomware exposure on a leak site.

About Clinica Tezza

Clinica Tezza is a private healthcare institution located in Lima, Peru. The clinic is affiliated with the Daughters of St. Camillus congregation and provides a variety of medical services. Its medical offerings include general surgery, emergency care, and various other medical specialties to the local community.

Implications and security considerations

This announcement by the LockBit group suggests that the institution's sensitive health data may be at risk. A data breach at a healthcare institution could lead to the violation of patient privacy and the potential misuse of personal health information by malicious actors. Such incidents pose significant risks to both the institution and the individuals whose data is stored within the system.

Under Peruvian data protection regulations, the institution may be required to report this incident to relevant authorities and notify affected parties. Organizations operating in the healthcare sector must remain vigilant against secondary risks that often follow a data breach, such as identity theft and targeted phishing attacks aimed at patients or staff members.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. Despite facing operational disruptions in February 2024, the group appears to continue its activities. For organizations in the healthcare sector, maintaining robust security postures, implementing strict access controls, and ensuring regular backups are critical defensive steps to mitigate the impact of such threats.