Stages Pediatric Care targeted by Everest ransomware group

• Ransomware group: Everest
• Country: United States
• Sector: Healthcare
• Announcement date: October 23, 2022

Everest ransomware group claims data leak involving Stages Pediatric Care

The threat actor known as Everest has published a data leak announcement on its leak site, claiming to possess personal records belonging to Stages Pediatric Care. According to the announcement made on October 23, 2022, the group alleges that the stolen information includes 40 personal records. This incident follows a pattern of behavior observed in modern ransomware operations, where threat actors utilize public leak sites to pressure victims into meeting their demands.

Details of the alleged extortion attempt

The Everest ransomware group has listed data allegedly belonging to Stages Pediatric Care on its dedicated leak site. The group is currently employing extortion tactics, claiming that further data may be published if a ransom is not paid. The announcement includes a specific threat regarding the volume of information that could be exposed; it is stated that more than 200 additional records could be released if the institution fails to meet their demands. This tactic is a hallmark of double extortion, a method where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage during negotiations.

In such scenarios, ransomware groups aim to maximize pressure by threatening to release sensitive datasets to the public or to specific stakeholders. By claiming that the volume of leaked data will increase significantly upon non-compliance, the attackers attempt to escalate the perceived risk to the organization's reputation and legal standing.

Data types and potential impact

The information released by the group includes a sample table that illustrates the nature of the stolen data. Based on the provided screenshots, the leaked information reportedly contains highly sensitive personal identifiable information (PII). The specific data types mentioned in the leak include:

• Full name
• Address information
• Phone number
• Date of birth
• Social Security Number (SSN)

The exposure of such sensitive information, particularly Social Security Numbers and dates of birth, poses a significant risk to the affected individuals. This type of data is highly valued by malicious actors for identity theft and various forms of financial fraud. When such information is leaked, the individuals involved may face long-term consequences as their identity can be misused in unauthorized transactions or for fraudulent applications.

Implications for the healthcare sector

The organization involved, Stages Pediatric Care, operates within the healthcare sector. Because the allegedly leaked data contains sensitive personal identifiable information, the exposure may lead to significant compliance issues under HIPAA regulations in the United States. Healthcare organizations are subject to strict regulatory frameworks designed to protect patient privacy and ensure the security of medical and personal data.

Given the past activities of the Everest group, it can be observed that the group utilizes data exfiltration and extortion tactics to exert pressure on their targets. This approach forces organizations to weigh the costs of a ransom payment against the potential legal, regulatory, and reputational damage caused by a public data breach.

For organizations operating in the healthcare sector, such incidents highlight the necessity of robust defensive measures. To mitigate the risks associated with such attacks, organizations must remain vigilant against secondary risks, such as targeted phishing attacks that often follow a data breach. Defensive strategies typically involve maintaining rigorous access controls, implementing continuous monitoring, and ensuring that all sensitive data is encrypted both at rest and in transit to minimize the impact of potential exfiltration.