PruittHealth listed on noescape ransomware leak site

• Ransomware group: noescape
• Country: United States
• Sector: Healthcare
• Announcement date: November 18, 2023

PruittHealth targeted by noescape ransomware group

PruittHealth, a healthcare organization operating in the United States, has been listed on the leak site of the noescape ransomware group. The threat actors behind the group claim to have successfully exfiltrated 1.5 TB of data from the organization's network. This announcement, made on November 18, 2023, follows a claimed attack date of November 13, 2023.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not merely encrypt a victim's files to demand a ransom for decryption; they also steal sensitive information before the encryption process begins. The threat of releasing this stolen data on public leak sites serves as additional leverage to pressure the victim into paying the ransom. This method increases the pressure on organizations, as the exposure of sensitive information can lead to significant legal, regulatory, and reputational consequences.

The claims made by noescape

According to the announcement, the noescape group claims to have carried out a targeted attack on the PruittHealth network on November 13, 2023. The threat actors have stated that they attempted to establish contact with the management of the organization to discuss the incident. However, the group claims that they have not received any response from the organization's leadership.

Due to this alleged lack of communication, the group has issued a threat to publish the allegedly exfiltrated data. The attackers have indicated that if the organization continues to remain silent and fails to respond to their communications, the stolen information will be released publicly on their leak site. This escalation is a common pressure tactic used by ransomware groups to force a response from targeted entities.

Data involved in the alleged breach

While the group claims to have stolen a significant volume of data totaling 1.5 TB, they have not provided specific details regarding the full contents of this data. The announcement includes a sample file to demonstrate the breach, which contains the organization's 2023-24 cyber insurance policy. No further details regarding the specific contents of the claimed 1.5 TB of data have been provided by the attackers.

The listing identifies the following as affected information:

• Corporate cyber insurance policy

The presence of a cyber insurance policy in the leaked samples suggests that the attackers may have gained access to documents detailing the organization's internal risk management and insurance coverage. No information was provided regarding the specific file count or the exact nature of the remaining 1.5 TB of data.

About PruittHealth

PruittHealth is a family-owned healthcare organization that has been operating for over 50 years. The company provides a range of post-acute care services, including skilled nursing care, home health care, and rehabilitation services.

Potential implications and sector risks

The claim of a data breach involving a healthcare organization poses a significant risk of exposure for sensitive data. Because PruittHealth operates within the United States, a potential data breach could trigger complex legal processes under HIPAA (Health Insurance Portability and Accountability Act) regulations, which govern the protection of sensitive patient health information.

The fact that a sample file regarding internal processes, such as a cyber insurance policy, was shared indicates that information regarding the organization's internal operations may have been exposed. Such exposure can lead to secondary risks, including identity theft or highly targeted phishing attacks directed at the organization's employees and patients. When attackers possess internal documentation, they can craft more convincing social engineering attacks.

For organizations operating in the healthcare sector, these types of incidents underscore the necessity of robust network security processes. Defensive strategies often include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits. Furthermore, if a breach is suspected, organizations may need to re-evaluate their security posture and follow protocols to notify all affected parties to mitigate further harm.