Prestige Care listed on ALPHV ransomware leak site

• Ransomware group: ALPHV
• Country: United States
• Sector: Healthcare
• Announcement date: September 26, 2023

ALPHV claims data breach against Prestige Care

The ALPHV ransomware group has listed the US-based healthcare provider Prestige Care on its dedicated leak site. According to the announcement made by the threat actor group, the organization has been targeted in a cyberattack, resulting in a significant data leak. The listing, which appeared on the group's platform on September 26, 2023, suggests that various sensitive records belonging to the organization may have been compromised during the incident.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms by threatening to release stolen information. These groups often employ a tactic known as double extortion, where they not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to publish this data publicly, attackers aim to maximize the pressure on the victim to comply with their demands.

Details of the alleged data theft

The announcement made by the ALPHV group indicates that a vast amount of information has been exfiltrated. While the specific volume of data is subject to the group's claims, the listing suggests that the breach involves a wide array of sensitive categories. The information identified in the group's claims includes various operational and personal records that could be highly sensitive given the nature of the organization's work.

Based on the information provided by the threat actor, the following types of data are claimed to be involved in the leak:

• Personal data
• Financial records
• HR data
• Marketing data
• Sharepoint data

The group has claimed that the Sharepoint data alone is approximately 2 TB in size, though no specific ransom demand has been made public in the provided information. No information was given regarding the exact number of files or the specific amount of the ransom demand.

About Prestige Care

Prestige Care is a healthcare organization that operates more than 80 senior living communities throughout the western United States. Founded in 1985, the company provides comprehensive senior care services, including assisted living and independent living. Given its role in providing essential care to senior citizens, the organization handles a significant amount of sensitive information related to both its staff and the individuals it serves.

Potential impact and industry implications

This alleged data leak may increase the risk of identity theft and fraud for both employees and the senior individuals served by the organization. Because the entity operates within the healthcare sector, the incident could potentially lead to legal and administrative sanctions under regulations such as HIPAA, which governs the protection of sensitive patient health information.

Considering the double-extortion tactics historically employed by the ALPHV group, it is possible that the organization's operational continuity could be negatively impacted. When attackers threaten to release data, they create a dual crisis: the immediate technical disruption of encrypted systems and the long-term reputational and legal crisis of a public data exposure. Furthermore, the leaked data may be utilized for secondary attacks or targeted phishing campaigns, where criminals use stolen information to craft highly convincing messages to trick individuals into revealing even more sensitive data.

For organizations operating in the healthcare sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, immutable backups is a standard practice to mitigate the impact of encryption-based ransomware attacks and ensure operational continuity.