Qilin ransomware group lists Meli (BCYF & Bethany) on its leak site

• Ransomware group: Qilin
• Country: Australia
• Sector: Healthcare
• Announcement date: August 26, 2024

Qilin claims ransomware attack against Meli

The Qilin ransomware group has listed the Australian-based organization Meli on its dedicated leak site. According to the announcement made by the threat actor group on August 26, 2024, the organization has been targeted in a cyberattack. The group claims to have gained unauthorized access to the organization's network as early as July 16, 2024.

The threat actors are utilizing a double-extortion strategy in this incident. In such scenarios, ransomware groups typically exfiltrate sensitive information from a victim's network before deploying encryption. The group then uses the threat of leaking this stolen data on their public leak site to exert maximum pressure on the victim to facilitate ransom payments. By making the data public, the attackers aim to damage the organization's reputation and cause legal or regulatory distress, thereby increasing the likelihood of a successful extortion attempt.

The claimed data breach and affected information

While the specific volume of data and the exact number of files stolen have not been disclosed by the group, the announcement indicates that sensitive information has been exfiltrated. The listing includes blurred samples intended to serve as proof of the breach. Based on the available information, the data allegedly stolen includes the following types of information:

• Identity documents
• Personal data
• Corporate records

The presence of identity documents and personal information in a leak is particularly critical, as these assets are highly valued on illicit markets for identity theft and fraudulent activities.

About Meli

Meli is a not-for-profit social services organization based in Victoria, Australia. The organization focuses on providing essential support to individuals and families, covering a wide range of developmental stages from early childhood through to adulthood.

Analysis and implications for the healthcare and social services sector

This incident highlights the significant risks faced by organizations operating within the healthcare and social services sectors. Because these entities manage highly sensitive personal and medical information, they are prime targets for sophisticated ransomware groups like Qilin. The potential exposure of such data can lead to severe consequences for both the organization and the individuals it serves.

Under Australian data protection regulations, an organization facing a breach of this nature may be required to fulfill specific data breach notification obligations. These regulations are designed to ensure transparency and allow affected individuals to take steps to protect themselves from potential misuse of their information.

The presence of identity documents among the leaked samples significantly increases the risk of identity theft and fraud for the affected individuals. When attackers possess verified identity documents, they can more easily impersonate victims to open fraudulent accounts, access financial services, or commit other forms of identity-based crime.

For organizations in similar sectors, this event underscores the importance of maintaining a robust security posture. Defensive strategies often include implementing multi-factor authentication, conducting regular security audits, and maintaining offline backups to mitigate the impact of encryption-based attacks. Furthermore, because double-extortion relies on the threat of data exposure, organizations must prioritize the protection of data exfiltration paths and implement strict data loss prevention measures. It is often considered advisable for organizations to proactively notify affected individuals and conduct thorough reviews of their security frameworks following such an incident.