Polyclinique du Cotentin listed on LockBit3 ransomware leak site

• Ransomware group: LockBit3
• Country: France
• Sector: Healthcare
• Announcement date: December 6, 2023

LockBit3 claims data breach at Polyclinique du Cotentin

The LockBit3 ransomware group has published an announcement on its leak site claiming to have obtained data belonging to polyclinique-cotentin.com. This listing, which appeared on December 6, 2023, identifies the target as a medical clinic operating in Cherbourg-en-Cotentin, France. The group has threatened to publish the institution's data as a result of the alleged attack.

Ransomware groups often utilize leak sites to exert pressure on victims through a tactic known as double extortion. In such scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also steal sensitive information. The threat of leaking this data publicly serves as a powerful lever to coerce the victim into paying a ransom. While the listing serves as a claim by the threat actor, it highlights the ongoing risks faced by critical infrastructure and service providers.

Details of the alleged incident

According to the announcement made by the LockBit3 group, the attack was claimed to have occurred on December 6, 2023. The group's post specifically targets the digital presence of the French medical center, asserting that they have successfully exfiltrated information from the organization's network.

Regarding the specific nature of the information involved in this incident, the listing names no specific data types. There is no specific information regarding the nature of the alleged leaked data in the available records or screenshots provided by the group.

About Polyclinique du Cotentin

Polyclinique du Cotentin is a private medical center located in Cherbourg-en-Cotentin, France. The institution provides a wide range of medical services, including both outpatient and inpatient care, across various medical specialties to the local population.

Potential implications and industry risks

This situation may indicate that the institution could face the risk of exposing patient and employee data. As a healthcare provider, the potential leak could lead to administrative and legal consequences under GDPR. The publication of such data may bring secondary risks for patients, including identity theft and targeted phishing attacks.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been monitored since 2019. It is assessed that they may continue their operations despite the disruption of their infrastructure in February 2024. The impact of such attacks on a healthcare institution can be significant, potentially affecting the organization's operational continuity and patient privacy.

For organizations operating within the healthcare sector, maintaining robust defensive postures is essential. Common defensive steps include implementing strict access controls, ensuring regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized exfiltration. Because healthcare entities handle sensitive personal information, they are frequent targets for sophisticated threat actors seeking to exploit the high stakes of medical data privacy.