RansomHub claims to have stolen data from G-plans.com

• Ransomware group: RansomHub
• Country: United States
• Sector: Healthcare
• Announcement date: October 16, 2024

RansomHub claims a data breach at G-plans.com

The threat actor known as RansomHub has officially listed data allegedly belonging to the nutrition and wellness platform G-plans.com on its dedicated leak site. According to the announcement made on October 16, 2024, the group claims to have successfully gained unauthorized access to the organization's internal systems, resulting in the theft of a significant volume of sensitive information.

The group asserts that the breach occurred on the same day the announcement was posted, October 16, 2024. The total volume of the stolen data is claimed to be approximately 5.09 GB, consisting of a massive collection of approximately 53,550 files. While the group has published the claim, no specific ransom demand has been disclosed in the public announcement.

Details of the alleged data theft

The information released by RansomHub suggests a highly sensitive breach involving personal health information. Screenshots shared as part of the group's announcement appear to confirm the presence of medical test results and private health data belonging to the organization's user base. This type of data is particularly sensitive as it pertains to the physical well-being and medical history of individuals.

The specific types of data allegedly included in the leak are:

• Patient health records
• Personally identifiable information
• Prescription details
• Diagnosis codes

Beyond these categories, the leaked content is said to include specific identifiers such as user names, dates of birth, contact addresses, and detailed medical test results, including TSH and lipid panels. The inclusion of such specific medical metrics highlights the potential severity of the exposure for the individuals involved.

About G-plans.com

G-plans.com is a platform that offers personalized nutrition and wellness plans based on metabolic typing. Founded by Dr. Philip Goglia, the company provides customized diet and fitness programs designed to help individuals achieve their specific health goals through tailored nutritional guidance.

Risk assessment and implications

This alleged leak poses significant secondary risks to the affected users. The exposure of personally identifiable information combined with medical data can facilitate identity theft and highly targeted phishing attacks. When attackers possess specific medical details, they can craft much more convincing social engineering campaigns to manipulate victims.

Because the organization processes sensitive health data, this incident may trigger specific legal obligations. Under US HIPAA regulations, organizations that handle protected health information may face mandatory data breach notification requirements. Furthermore, the public release of such data can lead to long-term negative impacts on individual privacy rights and significant reputational damage for the organization involved.

The tactics used by RansomHub are consistent with double-extortion methods. In a double-extortion scenario, attackers do not just encrypt an organization's data to demand a ransom for decryption; they also steal the data and threaten to leak it publicly to pressure the victim into paying. RansomHub has been previously associated with former ALPHV affiliates, a connection that underscores the sophisticated nature of these threats.

For organizations operating within the healthcare sector, maintaining robust defensive postures is critical. This includes implementing strict access controls, continuous monitoring of network traffic for anomalous behavior, and ensuring comprehensive encryption for data both at rest and in transit. Regular security audits and employee training on phishing awareness are also standard defensive steps to mitigate the risk of such breaches.