Malekteam claims data breach at ZIV Hospital

• Ransomware group: Malekteam
• Country: Israel
• Sector: Healthcare
• Announcement date: December 24, 2023

The ransomware group known as Malekteam has announced a significant data breach involving ZIV Hospital. According to an announcement made on a leak site on December 24, 2023, the group claims to have successfully conducted a cyber attack against the medical institution, gaining unauthorized access to its internal systems.

The details of the alleged attack

Malekteam claims that the breach occurred on December 24, 2023. During the operation, the group alleges that they managed to exfiltrate a substantial amount of information, totaling over 500 GB of data. This stolen information reportedly consists of medical documents and various database contents belonging to the institution.

The scope of the impact is described by the group as being exceptionally large. Malekteam claims that the stolen data belongs to more than 300,000 individuals, including both patients and their companions. Furthermore, the group has made the specific claim that the leaked data includes documents related to the Israel Defense Forces (IDF).

The types of data allegedly stolen

The information allegedly obtained by the attackers is highly sensitive, covering a wide range of personal and medical details. Based on the claims made by Malekteam, the leaked data includes the following items:

• Patient names
• Identity numbers
• Contact details
• Types of diseases
• Drug information
• Genetic codes
• DNA and RNA data
• IDF-related medical documents

The inclusion of such granular biological and personal information highlights the sensitive nature of the targeted data. While the group has made these claims, no information was provided regarding a specific ransom demand.

The organization involved

Ziv Medical Center is a hospital located in Safed, Israel, providing comprehensive medical services to the region.

Implications and security considerations

This alleged breach poses a severe risk to patient privacy and the protection of highly sensitive personal data. The nature of the information claimed to be leaked—specifically genetic codes, DNA, and RNA data—presents unique long-term risks. Such biological information is immutable, meaning that once it is compromised, it cannot be changed like a password or a credit card number, potentially leading to permanent risks of identity theft or highly targeted phishing attacks against the affected individuals.

From a regulatory perspective, the institution may face legal consequences given the strict Israeli regulations and standards established for the protection of health data. The incident within the institution's systems could potentially lead to secondary data breaches and significant operational disruptions.

In the broader context of cyber threats, this incident reflects the growing trend of double extortion tactics used by ransomware groups. In these scenarios, attackers do not just encrypt systems to disrupt operations; they also steal sensitive data to threaten the victim with public disclosure unless a ransom is paid. This increases the pressure on organizations, especially in the healthcare sector where data sensitivity is at its highest.

To defend against such threats, organizations in the healthcare sector typically focus on several defensive pillars. Implementing robust encryption for data at rest and in transit is essential for protecting sensitive patient records. Furthermore, strict access controls and multi-factor authentication (MFA) can help prevent unauthorized access to critical systems. Regular security audits, continuous monitoring of network traffic for anomalies, and comprehensive employee training on phishing awareness are also vital components of a modern cybersecurity posture designed to mitigate the risk of such high-impact breaches.