Spine by Villamil MD targeted by Everest ransomware group

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: October 25, 2024

Everest ransomware group claims data breach at Spine by Villamil MD

The Everest ransomware group has announced on its leak site that it has targeted Spine by Villamil MD, claiming to have obtained sensitive information. According to the group's announcement, they intend to publish data belonging to the medical center, asserting that they possess the medical records of more than 1,000 patients. The announcement on the leak site includes a countdown timer, indicating a deadline for the potential publication of the stolen information.

Details of the alleged data theft

The claims made by the Everest group suggest a significant breach of sensitive information. While the specific volume of files or the exact ransom amount remains unknown, the group has provided samples to support their claims. These samples include various types of sensitive documentation that could potentially be used for malicious purposes.

Based on the screenshots provided by the threat actors, the following types of data are reportedly involved in the breach:

• Patient names
• Social security numbers (SSN)
• Dates of birth
• Patient medical records
• Medical report samples including examination notes and diagnosis information

The presence of such highly sensitive personal identifiers, particularly social security numbers and medical diagnoses, significantly increases the risk profile of the incident for the affected individuals.

About Spine by Villamil MD

Spine by Villamil MD is a medical center based in Florida, USA, specializing in spine health and surgery. Led by Dr. Alejandro Villamil, the practice provides orthopedic and neurological spinal treatments to its patients.

Risks and implications of the incident

The alleged leak poses significant risks to patient privacy. For an organization operating within the United States, such a breach can lead to complex legal proceedings and administrative sanctions under HIPAA regulations. The nature of the stolen data, which includes highly personal identifiers, makes it a prime target for identity theft and highly targeted phishing attacks. In these scenarios, attackers use stolen personal details to impersonate individuals or gain further access to sensitive systems.

The Everest group, which has been active since 2020, is known for employing data exfiltration and extortion tactics to exert pressure on their targets. This method, often referred to as double extortion, involves stealing data before encrypting systems, allowing the attackers to threaten the release of sensitive information if a ransom is not paid.

In the healthcare sector, such incidents highlight the ongoing necessity for robust cybersecurity frameworks. Organizations in this sector often face unique challenges due to the high value of medical data on the dark web. To mitigate these risks, it is common for organizations to implement strict access controls, continuous monitoring, and comprehensive employee training to recognize phishing attempts. Furthermore, maintaining rigorous compliance with regulatory standards is a critical component of defensive strategies. Both the organization and the affected patients may need to remain vigilant against secondary risks, such as fraudulent communications or identity theft attempts resulting from the breach.