Morrison Community Hospital targeted by ALPHV in massive data leak claim

• Ransomware group: ALPHV
• Country: United States
• Sector: Healthcare
• Announcement date: October 28, 2023

ALPHV claims massive data leak against Morrison Community Hospital

The ransomware group known as ALPHV has listed data allegedly belonging to Morrison Community Hospital on its leak site. According to the group's announcement, the breach involves a massive volume of information, totaling approximately 8.6 TB. This claim suggests a significant compromise of the healthcare provider's digital infrastructure, involving both large-scale databases and sensitive individual credentials.

Ransomware groups often utilize leak sites to pressure victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data, threatening to publish it publicly if a ransom is not paid. This method increases the pressure on the victim by threatening reputational damage and legal consequences resulting from the exposure of private information.

Details of the alleged breach

The claim, announced on October 28, 2023, asserts that the stolen data includes several high-value components. The group alleges that the leak contains approximately 8.6 TB of data, which reportedly includes five virtual machine images and various SQL databases. Beyond these large files, the group claims to have obtained browser-based credentials that allegedly belong to hospital employees and the CEO of the organization.

The contents of the leaked data, as described by the group, are highly sensitive and include:

• Patient medical records
• Patient admission summaries
• Tax forms (1095-C)
• Identification cards
• Employee credentials

The inclusion of administrative and executive credentials, such as those belonging to the CEO, significantly elevates the severity of the incident, as such access can often be used to pivot through a network or access highly restricted systems.

About Morrison Community Hospital

Morrison Community Hospital is a critical access hospital located in Morrison, Illinois. The institution is dedicated to providing personalized medical services to local residents and focuses on delivering immediate and life-improving healthcare services to the community it serves.

Risk assessment and industry implications

The exposure of the data claimed by ALPHV poses a high risk to the organization and the individuals involved. The leak involves sensitive patient health information, which is highly regulated. As a United States-based healthcare provider, the incident may trigger legal processes and regulatory penalties under the Health Insurance Portability and Accountability Act (HIPAA), which mandates the protection of sensitive patient data.

Furthermore, the exposure of employee credentials presents a secondary security risk. Such information can be exploited by threat actors to facilitate subsequent attacks or highly targeted phishing attempts against the organization's internal network. Organizations in the healthcare sector often face these challenges, as they manage vast amounts of Protected Health Information (PHI) that is highly valuable on the dark web.

To defend against such threats, organizations typically implement multi-factor authentication (MFA) to mitigate the risk of stolen credentials, maintain robust backup strategies, and conduct regular security awareness training for employees. ALPHV, also known as BlackCat, is a Ransomware-as-a-Service (RaaS) group that emerged in late 2021 and utilized Rust-based malware. While the group was subject to law enforcement operations in December 2023, it was reportedly reported to have ceased operations as of March 2024.