Paciente.sempremedico.com.br listed on RansomHub leak site

• Ransomware group: RansomHub
• Country: Brazil
• Sector: Healthcare
• Announcement date: October 19, 2024

RansomHub claims breach of Brazilian healthcare platform

The Brazilian healthcare platform paciente.sempremedico.com.br has been listed on the RansomHub ransomware group's leak site. According to the announcement made on October 19, 2024, the threat actor group claims to have gained unauthorized access to the platform's systems. This incident follows a claimed attack date of October 16, 2024.

The RansomHub group has posted an announcement regarding a data leak involving the organization. By listing the target on their leak site, the group aims to pressure the victim, a tactic often associated with modern ransomware operations. While the group claims to have successfully infiltrated the platform, the specific details regarding the total volume of data stolen or the specific ransom demand have not been disclosed in the announcement.

Details of the alleged data leak

The threat actors claim to have accessed various patient records and shared samples to prove the validity of their breach. The leaked information appears to target the core processes of the platform, specifically focusing on patient-doctor interactions and the management of medical records. Based on the screenshots provided by the group, the sensitive information involved includes:

• Patient medical records
• Physician identification data
• Prescription details
• Health insurance data

The content of the shared screenshots is particularly concerning as it reportedly contains highly sensitive information. This includes patient names, medical diagnoses, and details regarding surgical procedures. Furthermore, the data includes physician details, specifically mentioning CRM numbers, as well as prescriptions and health insurance information. Such a combination of data points represents a significant privacy risk for the individuals involved.

About Sempre Médico

Sempre Médico is a healthcare platform operating in Brazil. The organization's primary mission is to facilitate communication between patients and doctors. To achieve this, the platform offers a variety of digital services, including appointment scheduling, the management of medical records, and telemedicine capabilities. Because the platform serves as a central hub for medical administration and communication, it handles a high volume of sensitive personal and health-related data.

Implications and industry risks

The data allegedly leaked in this incident may constitute sensitive personal health information under Brazil's LGPD regulations. Such a breach can lead to severe privacy violations for patients and may result in secondary risks, such as identity theft. Given that the RansomHub group is thought to have been associated with ALPHV, it is possible that they have employed double-extortion tactics. Double extortion is a method where attackers not only encrypt an organization's data but also steal it, threatening to leak the sensitive information publicly if a ransom is not paid.

Because the entity provides essential healthcare services, this breach may likely have long-term impacts on patient trust. Furthermore, the leaked physician information, including professional identification numbers, could potentially be utilized for targeted phishing attacks against healthcare professionals. In the healthcare sector, such attacks often aim to gain further access to medical networks or to commit insurance fraud.

For organizations operating in the healthcare sector, maintaining robust cybersecurity defenses is critical. This includes implementing multi-factor authentication, ensuring regular software patching, and conducting frequent security audits. Protecting sensitive patient data requires a multi-layered approach to defense to mitigate the risks of both data encryption and data exfiltration.