Stages Pediatric Care data allegedly leaked by Everest ransomware group

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: October 23, 2022

The Everest ransomware group has published what it claims to be 250 personal records belonging to Stages Pediatric Care on its leak site. This announcement, made on October 23, 2022, suggests a targeted data exfiltration operation aimed at the healthcare provider.

The alleged attack and claims by Everest

According to the information provided by the threat actor, the Everest group claims to have gained unauthorized access to the systems of Stages Pediatric Care. Following this access, the group asserts that they successfully exfiltrated personal records belonging to the organization. The claim was officially listed on the group's leak site on October 23, 2022, which coincides with the date the attack was allegedly carried out.

Ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information before the encryption occurs. By threatening to leak this stolen data on a public leak site, the attackers aim to increase the pressure on the victim to pay a ransom. The presence of a leak site serves as a public bulletin board where the group can shame the victim and demonstrate the validity of their breach to potential victims and the public.

The group's claim is supported by a provided screenshot, which displays a list containing sensitive information of numerous individuals. This visual evidence is a common method used by ransomware groups to prove the legitimacy of their claims to both the victim and the broader cybersecurity community.

Sensitive information involved in the leak

The data allegedly compromised in this incident includes highly sensitive personal information. Based on the screenshot provided by the threat actor, the records contain a variety of identifiers that could be used for malicious purposes. The specific types of data mentioned in the listing include:

• Full names
• Physical addresses
• Phone numbers
• Dates of birth
• Social security numbers (SSN)

The exposure of such a diverse set of identifiers is particularly dangerous. When full names are combined with physical addresses, phone numbers, and government-issued identifiers like social security numbers, the risk of identity theft and fraud increases significantly. This combination of data allows malicious actors to impersonate individuals in various financial, legal, and medical contexts.

Implications and risks for the healthcare sector

The alleged leak of data from a healthcare organization carries significant implications. For the individuals whose information was purportedly stolen, the risk of identity theft and fraud is high. Furthermore, the exposure of sensitive data within the healthcare sector can lead to severe regulatory consequences. In the United States, healthcare providers are subject to strict data protection standards under the Health Insurance Portability and Accountability Act (HIPAA), and breaches of this nature often trigger investigations and potential legal penalties.

The Everest group is identified as a Russian-speaking actor known for utilizing data exfiltration and extortion tactics. Such groups often target sectors that handle large volumes of sensitive personal information to maximize their leverage during negotiations.

To defend against such threats, organizations in the healthcare sector and other high-stakes industries must remain vigilant. Common defensive strategies include implementing robust access controls, maintaining rigorous monitoring of network traffic for unusual data movement, and ensuring that all sensitive data is encrypted both at rest and in transit. Following a breach, both the organization and the affected individuals may need to remain highly alert to secondary attacks, such as targeted phishing attempts, where attackers use the stolen information to gain further access or to further deceive the victims.