MHM Health listed on Rhysida ransomware leak site

• Ransomware group: Rhysida
• Country: United States
• Sector: Healthcare
• Announcement date: November 11, 2023

Rhysida claims to have targeted MHM Health

The Rhysida ransomware group has listed MHM Health on its dedicated leak site, claiming to have successfully targeted the organization and obtained sensitive data. This announcement, made on November 11, 2023, follows the group's established pattern of claiming responsibility for breaches against various entities to exert pressure on victims.

The group has created a formal leak announcement alleging that they have compromised the systems of MHM Health. According to the claims made by the threat actors, they have managed to extract a significant volume of information from the organization's infrastructure. While the group has shared a portion of the data as a demonstration of their access, they have also suggested that the remaining portion of the stolen information may be released if their demands are not met.

This type of activity is characteristic of modern ransomware operations, which often utilize a double-extortion tactic. In such scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish the stolen information on public leak sites, the attackers aim to create reputational and legal pressure on the victim organization to pay a ransom.

Details of the claimed data theft

The details provided in the leak announcement regarding the stolen information are specific in terms of volume but remain vague regarding the actual content. The Rhysida group claims to have obtained a massive dataset from the organization's systems. While the specific nature of the files has not been disclosed by the group, the scale of the theft is substantial.

The group's claims include the following details regarding the stolen data:

• Total data size: 294 GB
• Total file count: 593,521 files

The announcement does not provide specific details regarding the content of the data, and the group has not specified the exact types of files or the nature of the information contained within the 294 GB dataset. The listing names no specific data types beyond the total volume and file count.

About MHM Health

MHM Health is a healthcare organization dedicated to helping independent physician associations remain independent as the healthcare industry transitions to value-based care. The organization operates within the United States healthcare sector, providing support to physician groups during significant industry shifts.

Implications and sector risks

The fact that the Rhysida group targets the healthcare sector increases the possibility that the leaked data contains sensitive patient or employee information. Because healthcare organizations handle highly regulated data, such a breach may lead to legal sanctions under healthcare data protection regulations in the region where the organization operates. The publication of such data may create secondary risks for affected individuals, such as identity theft or targeted phishing attacks.

The group's double-extortion method may negatively impact the organization's operational continuity and reputation. For healthcare entities, the loss of data integrity and confidentiality can disrupt patient care and erode the trust established with both medical professionals and patients.

The actions of this group, which emerged in 2023, against healthcare institutions may highlight the need for increased security measures across the sector. To defend against such threats, organizations typically focus on implementing robust security frameworks, such as multi-factor authentication, regular data backups, and continuous monitoring of network traffic to detect unauthorized exfiltration. Strengthening defenses against ransomware requires a multi-layered approach to protect both operational continuity and sensitive data assets.