Pureform Radiology Center targeted by Everest ransomware group

• Ransomware group: Everest
• Country: Canada
• Sector: Healthcare
• Announcement date: September 23, 2024

The Everest ransomware group has officially listed the Canadian healthcare provider Pureform Radiology Center on its data leak site. According to the claims made by the threat actors, the group has successfully exfiltrated sensitive medical records and various internal documents belonging to the organization. This announcement, made on September 23, 2024, marks a significant potential breach involving highly sensitive patient information.

The claims made by Everest

The threat actors behind the Everest group allege that they have gained unauthorized access to the organization's internal systems. Beyond the theft of documents, the group has made a particularly alarming claim regarding a software vulnerability. They assert that they have discovered a zero-day exploit within the software used by the company that acquired Pureform Radiology Center.

The implications of this claimed vulnerability are vast. The group alleges that this specific zero-day exploit could potentially grant access to the medical records of over 10 million individuals. Such a claim suggests that the breach may extend beyond the immediate scope of the radiology center, potentially impacting a much larger population through the software supply chain.

Data and information involved

While the exact volume of the data has not been specified in terms of file counts or ransom demands, the group has identified several categories of information that they claim to have compromised. The announcement specifically highlights the following types of data:

• Medical records
• Internal documents
• Software vulnerability information

The mention of software vulnerability information alongside medical records indicates that the breach may involve not just patient data, but also technical details that could be used to facilitate further attacks against the organization's infrastructure or its partners.

About Pureform Radiology Center

Pureform Radiology Center is a medical imaging facility that operates within the province of Alberta, Canada. The institution plays a critical role in regional healthcare by providing a variety of diagnostic imaging services to its patients. Their service offerings include essential medical procedures such as X-rays, ultrasounds, and mammography.

Analysis and industry implications

This incident highlights the significant risks faced by healthcare providers regarding the exposure of personal health information. For an organization operating within Canada, such a breach may trigger legal processes and regulatory scrutiny under the Personal Information Protection and Electronic Documents Act (PIPEDA). The sensitive nature of medical data makes it a high-value target for ransomware groups who utilize double extortion tactics.

In double extortion, threat actors do not merely encrypt an organization's data to demand a ransom; they also steal the data and threaten to leak it publicly to increase pressure on the victim. This strategy is particularly effective against the healthcare sector, where the confidentiality of patient records is paramount. Given the history of the Everest group, there is a possibility that the stolen data could be utilized for secondary extortion or targeted phishing campaigns against patients and staff.

Furthermore, the claim of a zero-day exploit in a parent company's software introduces the risk of supply chain attacks. If the vulnerability is real, it could place numerous other healthcare entities using the same software at risk, creating a cascading effect across the medical sector. To defend against such threats, organizations in this sector must prioritize robust security infrastructures, implement strict access controls, and maintain rigorous patch management protocols to mitigate the risk of zero-day exploits. The organization and its associated software provider may need to conduct a thorough re-evaluation of their security frameworks to prevent future incidents.