Morrison Community Hospital targeted by ALPHV ransomware group

• Ransomware group: ALPHV
• Country: United States
• Sector: Healthcare
• Announcement date: October 13, 2023

The ALPHV ransomware group has published what it claims to be approximately 8.6 TB of data belonging to Morrison Community Hospital on its leak site. This announcement, made on October 13, 2023, suggests a significant data breach involving the healthcare provider.

The alleged attack and group claims

On October 28, 2023, the ALPHV group announced the publication of data allegedly belonging to Morrison Community Hospital. The threat actor shared torrent links for what they claim are five virtual machine images and SQL database files obtained from the institution's systems. This method of distribution is common in modern ransomware operations, where attackers use decentralized file-sharing protocols to distribute stolen data to the public or specific targets.

In addition to the database and virtual machine files, the group alleges that browser passwords belonging to employees and the CEO have been compromised. This type of claim is characteristic of double extortion tactics, where attackers not only encrypt an organization's systems but also threaten to release sensitive information to pressure the victim into paying a ransom.

The scope of the leaked data

The screenshots provided by the threat actor display sensitive documents that may include patient admission forms, personal identification cards, health insurance documents, and 1095-C tax forms. Furthermore, it is stated that employee credentials and browser data have been leaked. The following items are listed as being affected by this alleged breach:

• Patient health records
• Employee credentials
• Insurance information
• Tax forms
• Corporate credentials

Analysis of the threat actor

ALPHV, also known as BlackCat, is a known ransomware-as-a-service (RaaS) group that emerged in late 2021. The group is recognized for using a Rust-based codebase. Despite its presence in the cybercrime landscape, there is limited public information regarding the specific inner workings and operations of the group.

Organization profile and impact assessment

Morrison Community Hospital is a critical access hospital located in Morrison, Illinois. It provides personalized medical care and immediate health services to the residents of the hospital district and the surrounding area.

The allegedly leaked data may pose risks to patient privacy and institutional security. As the institution operates in the healthcare sector, this incident could lead to compliance issues under HIPAA regulations. The exposure of employee passwords may increase the risk of secondary attacks on the institution's networks and could facilitate identity theft. This leak may bring about the possibility of patients' personal data being misused by malicious actors.

Defensive considerations for the healthcare sector

While the specific details of the hospital's response are not available, organizations in the healthcare sector often face unique challenges due to the sensitive nature of the data they manage. Protecting against such threats typically requires a multi-layered defense strategy. This includes implementing robust access controls, enforcing multi-factor authentication to prevent the misuse of compromised credentials, and maintaining rigorous monitoring of network traffic to detect unauthorized data exfiltration.

Furthermore, regular backups and comprehensive incident response plans are essential for maintaining operational continuity. Because healthcare providers handle vast amounts of Protected Health Information (PHI), maintaining strict compliance with regulatory frameworks is a critical component of their security posture to mitigate the legal and reputational risks associated with data exposure.