PR Clinical targeted by Noescape ransomware group

• Ransomware group: Noescape
• Country: United Kingdom
• Sector: Healthcare
• Announcement date: October 31, 2023

Noescape group claims data breach at PR Clinical

The Noescape ransomware group has listed a significant amount of data allegedly belonging to PR Clinical on its leak site. According to the announcement, the group claims to have exfiltrated 9 GB of information from the organization. This incident was officially announced on the group's leak site on October 31, 2023, though the group claims the actual attack took place on October 25, 2023.

The threat actor known as Noescape claims to have successfully gained access to the network and subsequently encrypted the organization's data. Following the encryption of the systems, the group stated that they would proceed to publish the stolen data publicly if the organization fails to initiate contact with them. This pattern of behavior is characteristic of modern ransomware operations that utilize a double-extortion strategy. In such scenarios, attackers do not merely encrypt files to disrupt operations but also steal sensitive information to use as leverage, threatening to release it to pressure the victim into paying a ransom.

Alleged contents of the leaked data

The data allegedly stolen by the Noescape group is extensive and covers various sensitive categories. The contents of the leak, as claimed by the threat actors, include a wide array of documents and personal information that could be highly sensitive for both the organization and the individuals involved. The specific types of data mentioned in the claim include:

• Employee personal data
• Client personal data
• Financial records
• Agreements
• Passports
• Tax documents

Beyond these specific categories, the group further claims that the stolen information encompasses access credentials, insurance documents, purchase orders, audit reports, budget files, payment information, banking records, and invoices. The breadth of this alleged data set suggests a deep penetration into the organization's administrative and financial systems.

About PR Clinical

PR Clinical is a healthcare organization positioned as the first High Complexity Reference Laboratory in Puerto Rico and the Caribbean. The organization is managed by a team of specialists who focus on medical analysis and laboratory services, providing critical diagnostic support within its operational region.

Potential impact and industry implications

This incident may pose significant secondary risks for the organization, particularly regarding identity theft and fraud targeting the employees and clients whose data has been compromised. Given the sensitive nature of the allegedly leaked information, it is highly likely that legal processes under the UK GDPR will be triggered to address the exposure of personal data.

For an organization operating within the healthcare and social services sectors, the exposure of such information can lead to substantial reputational damage and significant operational disruptions. Furthermore, the publication of this data may have negative impacts on the organization's supply chain partners, who may also be at risk due to the interconnected nature of modern healthcare networks.

While public information regarding the specific methods and identity of the Noescape group remains limited, their reliance on double-extortion highlights a growing trend in the cyber threat landscape. Organizations in the healthcare sector can mitigate such risks by implementing robust defensive measures. These typically include maintaining offline backups, implementing strict access controls, conducting regular security audits, and ensuring comprehensive employee training to recognize phishing attempts. Protecting sensitive medical and personal data is critical to maintaining trust and ensuring compliance with international data protection regulations.