Ransomcortex ransomware group lists www.respirarlondrina.com.br on its leak site

• Ransomware group: Ransomcortex
• Country: Brazil
• Sector: Healthcare
• Announcement date: July 12, 2024

Ransomcortex claims to have stolen 90 GB of data from Instituto Respirar Londrina

The threat actor known as Ransomcortex has listed data allegedly belonging to the Brazilian healthcare institution Instituto Respirar Londrina on its dedicated leak site. According to the announcement made on July 12, 2024, the group claims to have successfully exfiltrated 90 GB of data from the organization's internal systems.

The claim of a breach was accompanied by the publication of sample files intended to prove the validity of the theft. These samples allegedly contain sensitive information belonging to both the institution's employees and its patients. While the group has made these claims public, it is important to note that public information regarding the specific operations and background of the Ransomcortex group remains limited.

Details of the alleged data exfiltration

The data identified in the leak site post is described as being of significant volume, totaling 90 GB. The threat actor's post included various samples to demonstrate the scope of the breach. These shared samples reportedly include highly sensitive documentation such as medical reports, financial spreadsheets, and even an image of a physician's identification card.

Based on the information provided by the threat actor, the affected data types include:

• Medical records
• Financial data
• Physician identification details

The presence of such diverse data types—ranging from clinical information to financial and personal identification documents—suggests a broad compromise of the institution's digital environment. The inclusion of physician identification specifically highlights the risk to individual staff members alongside the broader institutional data.

About Instituto Respirar Londrina

Instituto Respirar Londrina is a multidisciplinary hospital located in the city of Londrina, Brazil. The facility specializes in several critical medical fields, including pulmonology, infectious diseases, and thoracic surgery. Given its specialized nature, the institution handles sensitive patient information related to complex respiratory and infectious conditions.

Risk assessment and industry implications

The exposure of data from a healthcare institution carries significant implications. The leaked information, which includes medical records and personal identifiers, may pose secondary risks to the individuals involved. These risks include the potential for identity theft or the execution of targeted phishing attacks directed at the institution's employees and patients. Such attacks often leverage the sensitive context of medical data to increase the success rate of social engineering attempts.

From a regulatory perspective, the exposure of such data may lead to legal and administrative sanctions under Brazil's LGPD regulations. Healthcare providers are subject to strict data protection standards, and a breach of this nature necessitates a thorough review of system security and the notification of affected parties. The group's decision to publish samples is a characteristic indicator of a double extortion strategy. In such scenarios, ransomware actors do not merely encrypt systems but also steal data to use as leverage, threatening to release it publicly to pressure the victim into paying a ransom.

For organizations operating within the healthcare sector, such incidents underscore the necessity of robust defensive measures. Common industry practices to mitigate these risks include maintaining rigorous access controls, implementing comprehensive encryption for data at rest and in transit, and conducting regular security audits. Furthermore, continuous monitoring and employee training are essential components of a modern cybersecurity posture designed to defend against the evolving tactics of ransomware groups.