Lockbit3 ransomware group lists unimed.coop.br on its leak site

• Ransomware group: Lockbit3
• Country: Brazil
• Sector: Healthcare
• Announcement date: November 3, 2023

LockBit3 claims Unimed has been targeted in a ransomware attack

The LockBit3 ransomware group has officially listed the Brazilian medical cooperative Unimed on its dedicated leak site. This announcement, made on November 3, 2023, indicates that the threat actor group claims to have targeted the organization and intends to publish its data. While the listing confirms the group's intent to release information, the announcement does not include a specific ransom demand, nor does it provide details regarding the total volume of data involved in the incident.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive information. The threat of leaking this stolen data on a public platform serves as additional leverage to pressure the victim into paying a ransom. In this instance, the LockBit3 group has signaled its intention to follow through with the publication of the institution's data, though the specific timing and nature of the leak remain unconfirmed by the organization.

Details regarding the claimed data breach

At this stage of the investigation, there is no information regarding the specific type or content of the leaked data. The records and available screenshots do not provide details on what files were accessed or exfiltrated during the incident. Furthermore, the listing does not specify the quantity of files or the total size of the data set that the group claims to possess.

The listing names no specific data types or categories of information that have been compromised.

About Unimed

Unimed is a medical work cooperative and health insurance operator based in Brazil. It is recognized as the largest health cooperative in the world, maintaining a vast network that includes over 100,000 physicians. The organization serves millions of beneficiaries, making it a significant entity within the global healthcare landscape.

Risk assessment and industry implications

This incident poses a significant risk regarding the potential exposure of personal health data, given the extensive network of members and physicians associated with the institution. For organizations operating within the healthcare sector, such breaches can lead to severe consequences. Under Brazil's LGPD regulations, the institution could face legal sanctions resulting from the potential exposure of sensitive information.

The potential publication of data could facilitate various secondary cybercrimes, such as identity theft or highly targeted phishing attacks directed at patients and employees. Such attacks often exploit the sensitive nature of medical or personal information to gain further access to systems or to defraud individuals.

The LockBit group is a Ransomware-as-a-Service (RaaS) provider that has been active since 2019. Although its infrastructure was disrupted by international law enforcement operations in February 2024, its continued activity suggests that similar attacks may persist. For organizations in the healthcare sector, maintaining robust defensive measures is critical. Common defensive steps include implementing strict access controls, maintaining offline backups, and ensuring continuous monitoring of network traffic to detect unauthorized exfiltration of data. Given the high value of medical records on the dark web, healthcare providers remain a primary target for sophisticated RaaS groups like LockBit3.