National Health Mission. Department of Health & Family Welfare, Govt. of U.P targeted by Knight

• Ransomware group: Knight
• Country: India
• Sector: Healthcare
• Announcement date: October 10, 2023

Knight claims data breach against National Health Mission. Department of Health & Family Welfare, Govt. of U.P

The threat actor known as Knight has published a notice on its leak site, claiming to have obtained data belonging to the National Health Mission. Department of Health & Family Welfare, Govt. of U.P. This announcement, made on October 10, 2023, marks a potential significant breach of sensitive public health information in India.

Ransomware groups often utilize leak sites to increase pressure on their victims through a technique known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to release it publicly if a ransom is not paid. This tactic leverages the threat of reputational damage and regulatory scrutiny to compel payment. While the specific details regarding the volume of data or the ransom amount remain unknown, the presence of the organization on the Knight leak site confirms the group's intent to publicize the alleged incident.

The alleged incident and group profile

According to the announcement posted on October 10, 2023, the Knight group alleges that they have successfully breached the National Health Mission. Department of Health & Family Welfare, Govt. of U.P. To support their claim, the group provided screenshots that appear to show internal processes related to the organization's healthcare services. These visual proofs are commonly used by ransomware groups to demonstrate the legitimacy of their claims to both the victim and the public.

Information regarding the Knight group remains limited in the public domain. There is very little available information concerning their specific tactics, techniques, or procedures. This lack of public data is common for emerging or less-documented ransomware actors, making it difficult for security researchers to attribute attacks or predict the group's future movements. Despite this limited information, the targeting of a major government health department suggests a threat profile capable of disrupting operational continuity.

Data and platform details

The screenshots provided in the announcement offer a glimpse into the nature of the data involved. The images display a dashboard for the 'eKavach' health management platform, which is used by the organization for its healthcare service processes. The dashboard appears to contain various types of operational and sensitive information. The data claimed to be involved in this breach includes:

• Patient tracking data
• Healthcare worker operational data
• Birth and disease notification records

The exposure of such information, particularly through a management platform like eKavach, highlights the vulnerabilities inherent in digital health infrastructures. When operational dashboards are compromised, the breadth of information available to an attacker can extend from individual patient records to the logistical details of how healthcare services are delivered on the ground.

Security implications and risks

This alleged leak poses a significant risk to the security of the digital infrastructure of a public healthcare provider. Because the organization processes sensitive health data, the breach could have negative impacts on patient privacy. Furthermore, the exposure of such information may lead to secondary risks, such as identity theft, as personal details are often embedded within health records.

The potential consequences of this breach extend into legal and operational domains. Given that the organization handles vast amounts of health data, the incident may trigger legal processes under relevant local data protection regulations. Additionally, the stolen data could be utilized by threat actors to conduct targeted phishing attacks against healthcare workers, using the stolen operational details to craft highly convincing social engineering campaigns.

In the healthcare sector, maintaining the integrity and confidentiality of data is paramount. Organizations in this sector can take several defensive steps to mitigate such risks, including implementing strict access controls, ensuring robust encryption for data at rest and in transit, and conducting regular security audits of management platforms like eKavach. Continuous monitoring of network traffic and employee training on phishing awareness are also critical components of a modern cybersecurity posture designed to protect sensitive public health information.