Ragnar Locker ransomware group lists Updates: Israel "MYMC" on its leak site

• Ransomware group: Ragnar Locker
• Country: Israel
• Sector: Healthcare
• Announcement date: September 15, 2023

Ragnar Locker claims data breach at Mayanei Hayeshua Medical Center

The ransomware group known as Ragnar Locker has published an announcement on its leak site claiming a successful data breach targeting the Mayanei Hayeshua Medical Center in Israel. According to the group's claim, the attack resulted in the exfiltration of a significant volume of data. The announcement was published on September 15, 2023, and the group claims the attack occurred on the same date.

This type of activity is characteristic of modern ransomware operations, specifically the "double extortion" model. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also focus on stealing sensitive information before the encryption process begins. By threatening to release this stolen data on public leak sites, the attackers aim to exert maximum pressure on the victim to pay a ransom, leveraging the threat of reputational damage and regulatory scrutiny.

Details of the alleged data theft

The Ragnar Locker group has listed specific types of information that they claim to have stolen from the medical center. The group asserts that the stolen data is quite substantial in volume, claiming that approximately 1.4 TB of data has been exfiltrated from the organization's systems.

According to the group's announcement, the following types of data have been made accessible on their leak site:

• SQL database files
• Internal correspondence contained within PST files

The presence of these specific file types suggests a targeted effort to acquire both structured data and communication histories. SQL databases often contain the core operational and administrative data of an institution, while PST files are commonly used to store large amounts of email data, which can contain sensitive internal discussions and personal information.

Implications and potential risks

The alleged breach of a healthcare provider like Mayanei Hayeshua Medical Center carries significant risks. The exposure of such data can have profound implications for patient privacy and the security of sensitive health information. When medical records or databases are compromised, the personal details of patients become vulnerable to misuse. Furthermore, the exposure of internal correspondence can create secondary threats, potentially impacting the security of hospital staff and the overall continuity of hospital operations.

From a legal and regulatory perspective, the institution may face complex legal processes under Israeli data protection regulations following such an incident. The methods used by Ragnar Locker, which involve exfiltrating data prior to encryption, are designed to maximize operational disruption and leverage the stolen information for further exploitation. The stolen data could potentially be utilized by malicious actors for identity theft or for launching highly targeted phishing attacks against the organization or its stakeholders.

Defensive considerations for the healthcare sector

Healthcare organizations are frequent targets for ransomware groups due to the high value and sensitivity of the data they manage. To mitigate the risks associated with data exfiltration and ransomware, organizations in this sector typically focus on several defensive layers. Implementing robust data loss prevention (DLP) tools can help identify and block unauthorized transfers of sensitive information.

Furthermore, maintaining strict access controls and following the principle of least privilege can limit the ability of an attacker to move laterally through a network to find sensitive databases or email archives. Regular monitoring of network traffic for unusual patterns of data movement is also a critical component of a modern security posture. As threat actors continue to evolve their tactics, healthcare providers must prioritize the protection of both their operational systems and the integrity of the sensitive data they hold in trust.